The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7539 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: use-after-free due to race condition occurring in dvb_register_device() (CVE-2022-45884)

    * kernel: use-after-free due to race condition occurring in dvb_net.c (CVE-2022-45886)

    * kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c (CVE-2022-45919)

    * kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages     getting invalid opcode BUG in include/linux/swapops.h (CVE-2023-4732)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Intel 8.8 BUG SPR IOMMU: QAT Device Address Translation Issue with Invalidation Completion Ordering     (BZ#2221097)

    * RHEL 8.9: intel_pstate may provide incorrect scaling values for hybrid capable systems with E-cores     disabled (BZ#2223403)

    * Bring MD code inline with upstream (BZ#2235655)

    * NAT sport clash in OCP causing 1 second TCP connection establishment delay. (BZ#2236514)

    * ibmvnic: NONFATAL reset causes dql BUG_ON crash (BZ#2236701)

    * PVT:1050:NXGZIP: LPM of RHEL client lpar got failed with error HSCLA2CF in 19th loops (BZ#2236703)

    * xfs: mount fails when device file name is long (BZ#2236813)

    * NFSv4.0 client hangs when server reboot while client had outstanding lock request to the server     (BZ#2237840)

    * i40e: backport selected bugfixes (BZ#2238305)

    * Updates for NFS/NFSD/SUNRPC for RHEL 8.9 (BZ#2238394)

    * SCSI updates for RHEL 8.9 (BZ#2238770)

    * kernel: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35 at:
    sock_map_update_elem_sys+0x85/0x2a0 (BZ#2239475)

    * Random delay receiving packets after bringing up VLAN on top of VF with vf-vlan-pruning enabled     (BZ#2240751)

    * RHEL-8.9 RDMA/restrack: Release MR restrack when delete (BZ#2244423)

    Enhancement(s):

    * Intel 8.9 FEAT EMR power: Add EMR CPU support to intel_rapl driver (BZ#2230146)

    * Intel 8.9 FEAT EMR tools: Add EMR CPU support to turbostat (BZ#2230154)

    * Intel 8.9 FEAT EMR power: Add EMR support to the intel_idle driver (BZ#2230155)

    * Intel 8.9 FEAT EMR RAS: Add EDAC support for EMR (BZ#2230161)

    * Intel 8.9 FEAT general: intel-speed-select (ISST): Update to latest release (BZ#2230163)

    * Intel 8.9 FEAT cpufreq: intel_pstate: Enable HWP IO boost for all servers (BZ#2232123)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

According to the versions of the kernel package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or commit     739790605705ddcf18f21782b9c99ad7d53a8c11 (CVE-2023-0458)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege. (CVE-2023-2176)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

  - An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

  - A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink     socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP     flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of     the flaw, privilege escalation cannot be fully ruled out, although it is unlikely. (CVE-2023-3106)

  - A flaw was found in the subsequent get_user_pages_fast in the Linux kernel's interface for symmetric key     cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local     user to crash the system. (CVE-2023-3108)

  - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux     Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when     queue_event() fails. (CVE-2023-3159)

  - A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and     font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds     occurs leading to undefined behavior and possible denial of service. (CVE-2023-3161)

  - An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-     after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order     for an attacker to exploit this, the system must have netrom routing configured or the attacker must have     the CAP_NET_ADMIN capability. (CVE-2023-32269)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue     could allow a local user to crash the system. (CVE-2023-3358)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem' access.
    (CVE-2023-34256)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in     drivers/media/pci/dm1105/dm1105.c. (CVE-2023-35824)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0145 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2021-46972:
    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix leaked dentry

    Since commit 6815f479ca90 (ovl: use only uppermetacopy state in     ovl_lookup()), overlayfs doesn't put temporary dentry when there is a     metacopy error, which leads to dentry leaks when shutting down the related     superblock:

    overlayfs: refusing to follow metacopy origin for (/file0)     ...
    BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]     ...
    WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d     CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1     ...
    RIP: 0010:umount_check.cold+0x107/0x14d     ...
    Call Trace:
     d_walk+0x28c/0x950      ? dentry_lru_isolate+0x2b0/0x2b0      ? __kasan_slab_free+0x12/0x20      do_one_tree+0x33/0x60      shrink_dcache_for_umount+0x78/0x1d0      generic_shutdown_super+0x70/0x440      kill_anon_super+0x3e/0x70      deactivate_locked_super+0xc4/0x160      deactivate_super+0xfa/0x140      cleanup_mnt+0x22e/0x370
     __cleanup_mnt+0x1a/0x30      task_work_run+0x139/0x210      do_exit+0xb0c/0x2820      ? __kasan_check_read+0x1d/0x30      ? find_held_lock+0x35/0x160      ? lock_release+0x1b6/0x660      ? mm_update_next_owner+0xa20/0xa20      ? reacquire_held_locks+0x3f0/0x3f0      ? __sanitizer_cov_trace_const_cmp4+0x22/0x30      do_group_exit+0x135/0x380
     __do_sys_exit_group.isra.0+0x20/0x20
     __x64_sys_exit_group+0x3c/0x50      do_syscall_64+0x45/0x70      entry_SYSCALL_64_after_hwframe+0x44/0xae     ...
    VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...

    This fix has been tested with a syzkaller reproducer.

    CVE-2021-3739:
    A NULL pointer dereference flaw was found in the btrfs_rm_device function in fs/btrfs/volumes.c in the     Linux Kernel, where triggering the bug requires CAP_SYS_ADMIN. This flaw allows a local attacker to     crash the system or leak kernel internal information. The highest threat from this vulnerability is to     system availability.

    CVE-2021-4083:
    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4.

    CVE-2023-1611:
    A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This     flaw allows an attacker to crash the system and possibly cause a kernel information lea

    CVE-2022-0480:
    A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to     host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX)     file locks.

    CVE-2022-3606:
    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.

    CVE-2023-52583:
    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix deadlock or deadcode of misusing dget()

    The lock order is incorrect between denty and its parent, we should     always make sure that the parent get the lock first.

    But since this deadcode is never used and the parent dir will always     be set from the callers, let's just remove it.

    CVE-2023-52590:
    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change ocfs2 rename code to avoid touching renamed directory if     its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52591:
    In the Linux kernel, the following vulnerability has been resolved:

    reiserfs: Avoid touching renamed directory if parent does not change

    The VFS will not be locking moved directory if its parent does not     change. Change reiserfs rename code to avoid touching renamed directory     if its parent does not change as without locking that can corrupt the     filesystem.

    CVE-2023-52599:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix array-index-out-of-bounds in diNewExt

    [Syz report]     UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2     index -878706688 is out of range for type 'struct iagctl[128]'     CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023     Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:88 [inline]      dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106      ubsan_epilogue lib/ubsan.c:217 [inline]
     __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348      diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360      diAllocExt fs/jfs/jfs_imap.c:1949 [inline]      diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666      diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587      ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56      jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225      vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106      do_mkdirat+0x264/0x3a0 fs/namei.c:4129
     __do_sys_mkdir fs/namei.c:4149 [inline]
     __se_sys_mkdir fs/namei.c:4147 [inline]
     __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147      do_syscall_x64 arch/x86/entry/common.c:51 [inline]      do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82      entry_SYSCALL_64_after_hwframe+0x63/0x6b     RIP: 0033:0x7fcb7e6a0b57     Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44     00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48     RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053     RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57     RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140     RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000     R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0     R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

    [Analysis]     When the agstart is too large, it can cause agno overflow.

    [Fix]     After obtaining agno, if the value is invalid, exit the subsequent process.


    Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next     report by kernel test robot (Dan Carpenter).

    CVE-2023-52600:
    In the Linux kernel, the following vulnerability has been resolved:

    jfs: fix uaf in jfs_evict_inode

    When the execution of diMount(ipimap) fails, the object ipimap that has been     released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs     when rcu_core() calls jfs_free_node().

    Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as     ipimap.

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.

    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2023-6121:
    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.



    CVE-2022-45886:
    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.

    CVE-2022-45919:
    An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.

    CVE-2022-20423:
    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel

    CVE-2023-6606:
    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2023-6610:
    An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

    CVE-2024-0565:
    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.

    CVE-2023-26607:
    In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

    CVE-2022-42328:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2022-42329:
    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329).

    CVE-2023-42754:
    A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8903:32 advisory.

    * media: dvb-core: Fix use-after-free due on race condition at dvb_net     {CVE-2022-45886}
    * media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221     {CVE-2022-45919}
    * bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()     {CVE-2024-39487}
    * net: fix __dst_negative_advice() race {CVE-2024-36971}     CVE(s):
    CVE-2022-45886     An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.
    CVE-2022-45919     An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    CVE-2024-36971     In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race
    __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to     possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst).
    Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the     wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the     three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check     against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various     callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the     blamed commit, using UDP sockets.
    CVE-2024-39487     In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in     bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an     empty string, newval->string+1 will point to the byte after the string, causing an out-of-bound read. BUG:
    KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418 Read of size 1 at addr ffff8881119c4781 by     task syz-executor665/8107 CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1 Hardware name:
    QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: __dump_stack     lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description     mm/kasan/report.c:364 [inline] print_report+0xc1/0x5e0 mm/kasan/report.c:475 kasan_report+0xbe/0xf0     mm/kasan/report.c:588 strlen+0x7d/0xa0 lib/string.c:418 __fortify_strlen include/linux/fortify-     string.h:210 [inline] in4_pton+0xa3/0x3f0 net/core/utils.c:130 bond_option_arp_ip_targets_set+0xc2/0x910     drivers/net/bonding/bond_options.c:1201 __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767
    __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792 bond_opt_tryset_rtnl+0xda/0x160     drivers/net/bonding/bond_options.c:817 bonding_sysfs_store_option+0xa1/0x120     drivers/net/bonding/bond_sysfs.c:156 dev_attr_store+0x54/0x80 drivers/base/core.c:2366     sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334     call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline]     vfs_write+0x96a/0xd80 fs/read_write.c:584 ksys_write+0x122/0x250 fs/read_write.c:637 do_syscall_x64     arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x63/0x6b ---[ end trace ]--- Fix it by adding a check of string length     before using it.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12207 advisory.

    - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) [Orabug: 35005829]     {CVE-2023-0394}
    - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) [Orabug: 35005792] {CVE-2022-47929}
    - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983584]     {CVE-2023-23454}
    - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) [Orabug: 34983614]     {CVE-2023-23455}
    - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) [Orabug: 34820629]     {CVE-2022-41218}
    - media: dvbdev: fix refcnt bug (Lin Ma) [Orabug: 34983295] {CVE-2022-45885} {CVE-2022-45887}     {CVE-2022-45886} {CVE-2022-45919} {CVE-2022-45884}
    - media: dvbdev: adopts refcnt to avoid UAF (Lin Ma) [Orabug: 34983295] {CVE-2022-45887} {CVE-2022-45884}     {CVE-2022-45886} {CVE-2022-45919} {CVE-2022-45885}
    - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Zheyu Ma) [Orabug: 34555527] {CVE-2022-2873}
    - Bluetooth: L2CAP: Fix u8 overflow (Sungwoo Kim) [Orabug: 34880795] {CVE-2022-45934}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7549 advisory.

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-     after-free, related to dvb_register_device dynamically allocating fops. (CVE-2022-45884)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS     transfers response data to a system call, there are still local variable points to the memory region, and     if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a     denial of service. (CVE-2023-1192)

  - Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly     marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and     container escape. (CVE-2023-2163)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to     cause a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation in case that the attacker already has local privileges. (CVE-2023-5178)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2782-1 advisory.

    The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2023-35828: Fixed a use-after-free flaw inside renesas_usb3_remove in     drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
    - CVE-2023-35823: Fixed a use-after-free in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c     (bsc#1212494).
    - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via     TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed     local attackers to crash the system at device disconnect (bsc#1212129).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks     for CR0 and CR4 (bsc#1210294).
    - CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or     Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
    - CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some     Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable     escalation of privilege via local access (bsc#1211263).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
    - CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting     in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-     wrapper.S (bsc#1212155).
    - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands,     compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
    - CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
    - CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
    - CVE-2023-1249: Fixed a use-after-free flaw inside the core dump subsystem, that could have been used to     crash the system (bsc#1209039).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption     (bsc#1208600).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7549 advisory.

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-     after-free, related to dvb_register_device dynamically allocating fops. (CVE-2022-45884)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS     transfers response data to a system call, there are still local variable points to the memory region, and     if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a     denial of service. (CVE-2023-1192)

  - Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly     marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and     container escape. (CVE-2023-2163)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious local     privileged user to cause a use-after-free and double-free problem, which may permit remote code execution     or lead to local privilege escalation problem. (CVE-2023-5178)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6466-1 advisory.

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel contained a race condition during     device removal, leading to a use-after- free vulnerability. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-45886,     CVE-2022-45919)

    Hyunwoo Kim discovered that the Technotrend/Hauppauge USB DEC driver in the Linux kernel did not properly     handle device removal events. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2022-45887)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2022-48425)

    It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash     collisions in connection lookup table. A remote attacker could use this to cause a denial of service     (excessive CPU consumption). (CVE-2023-1206)

    Daniel Trujillo, Johannes Wikner, and Kaveh Razavi discovered that some AMD processors utilising     speculative execution and branch prediction may allow unauthorised memory reads via a speculative side-     channel attack. A local attacker could use this to expose sensitive information, including kernel memory.
    (CVE-2023-20569)

    Jana Hofmann, Emanuele Vannacci, Cedric Fournet, Boris Kopf, and Oleksii Oleksenko discovered that some     AMD processors could leak stale data from division operations in certain situations. A local attacker     could possibly use this to expose sensitive information. (CVE-2023-20588)

    It was discovered that the ARM64 KVM implementation in the Linux kernel did not properly restrict     hypervisor memory access. An attacker in a guest VM could use this to execute arbitrary code in the host     OS. (CVE-2023-21264)

    It was discovered that the IPv6 RPL protocol implementation in the Linux kernel did not properly handle     user-supplied data. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2023-2156)

    Yu Hao and Weiteng Chen discovered that the Bluetooth HCI UART driver in the Linux kernel contained a race     condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash). (CVE-2023-31083)

    Yang Lan discovered that the GFS2 file system implementation in the Linux kernel could attempt to     dereference a null pointer in some situations. An attacker could use this to construct a malicious GFS2     image that, when mounted and operated on, could cause a denial of service (system crash). (CVE-2023-3212)

    Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle     certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker     in a guest VM could use this to cause a denial of service (host system crash) or possibly execute     arbitrary code. (CVE-2023-34319)

    Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a null     pointer dereference vulnerability in some situations. A local privileged attacker could use this to cause     a denial of service (system crash). (CVE-2023-3772)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes     in certain operations, leading to an integer underflow and out-of-bounds read vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-38427)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate SMB     request protocol IDs, leading to a out-of- bounds read vulnerability. A remote attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-38430)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     packet header sizes in certain situations, leading to an out-of-bounds read vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-38431)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     command payload size, leading to a out-of-bounds read vulnerability. A remote attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-38432)

    It was discovered that the NFC implementation in the Linux kernel contained a use-after-free vulnerability     when performing peer-to-peer communication in certain conditions. A privileged attacker could use this to     cause a denial of service (system crash) or possibly expose sensitive information (kernel memory).
    (CVE-2023-3863)

    Laurence Wit discovered that the KSMBD implementation in the Linux kernel did not properly validate a     buffer size in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could     use this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2023-3865)

    Laurence Wit discovered that the KSMBD implementation in the Linux kernel contained a null pointer     dereference vulnerability when handling handling chained requests. A remote attacker could use this to     cause a denial of service (system crash). (CVE-2023-3866)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly handle session setup     requests, leading to an out-of-bounds read vulnerability. A remote attacker could use this to expose     sensitive information. (CVE-2023-3867)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket     release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-40283)

    It was discovered that some network classifier implementations in the Linux kernel contained use-after-     free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-4128)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    It was discovered that a race condition existed in the Cypress touchscreen driver in the Linux kernel     during device removal, leading to a use-after- free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4134)

    Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure     Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker     in a SEV guest VM could possibly use this to cause a denial of service (host system crash).
    (CVE-2023-4155)

    It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A     local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

    Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading     to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2023-4244)

    Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly     check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to     construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

    Kyle Zeng discovered that the networking stack implementation in the Linux kernel did not properly     validate skb object size in certain conditions. An attacker could use this cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-42752)

    Kyle Zeng discovered that the netfiler subsystem in the Linux kernel did not properly calculate array     offsets, leading to a out-of-bounds write vulnerability. A local user could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-42753)

    Kyle Zeng discovered that the IPv4 Resource Reservation Protocol (RSVP) classifier implementation in the     Linux kernel contained an out-of-bounds read vulnerability. A local attacker could use this to cause a     denial of service (system crash). Please note that kernel packet classifier support for RSVP has been     removed to resolve this vulnerability. (CVE-2023-42755)

    Kyle Zeng discovered that the netfilter subsystem in the Linux kernel contained a race condition in IP set     operations in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-42756)

    Thelford Williams discovered that the Ceph file system messenger protocol implementation in the Linux     kernel did not properly validate frame segment length in certain situation, leading to a buffer overflow     vulnerability. A remote attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-44466)

    Lonial Con discovered that the netfilter subsystem in the Linux kernel contained a memory leak when     handling certain element flush operations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2023-4569)

    Bing-Jhong Billy Jheng discovered that the Unix domain socket implementation in the Linux kernel contained     a race condition in certain situations, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4622)

    Budimir Markovic discovered that the qdisc implementation in the Linux kernel did not properly validate     inner classes, leading to a use-after-free vulnerability. A local user could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-4623)

    Alex Birnberg discovered that the netfilter subsystem in the Linux kernel did not properly validate     register length, leading to an out-of- bounds write vulnerability. A local attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-4881)

    It was discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel did not     properly handle network packets in certain conditions, leading to a use after free vulnerability. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-4921)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly handle removal of     rules from chain bindings in certain circumstances, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2023-5197)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7549 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: use-after-free due to race condition occurring in dvb_register_device() (CVE-2022-45884)

    * kernel: use-after-free due to race condition occurring in dvb_net.c (CVE-2022-45886)

    * kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c (CVE-2022-45919)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Random delay receiving packets after bringing up VLAN on top of VF with vf-vlan-pruning enabled     (BZ#2240750)

    * bpf_jit_limit hit again (BZ#2243011)

    * HPE Edgeline 920t resets during kdump context when ice driver is loaded and when system is booted with     intel_iommu=on iommu=pt (BZ#2244625)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.139 / 5.15.139_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-325-01 advisory.

    New kernel packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the kernel-generic security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers     et/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could     allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all,     which could also lead to a kernel information leak problem.(CVE-2023-4387)

    A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers     et/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may     allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity     check during cleanup.(CVE-2023-4459)

    A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system     (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing     sanity check.(CVE-2023-4385)

    A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition.(CVE-2023-4132)

    A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible.(CVE-2023-3006)

    A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This     flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network     packets to the backend, causing the backend to crash.(CVE-2023-34319)

    A use-after-free flaw was found in nfc_llcp_find_local in net     fc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact     a kernel information leak issue.(CVE-2023-3863)

    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.(CVE-2022-45886)

    In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.(CVE-2023-21255)

    A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue     could allow a remote user to crash the system.(CVE-2023-3338)

    An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in     drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the     NULL Pointer Dereference.(CVE-2023-3220)

    A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue     could allow a local user to crash the system.(CVE-2023-3358)

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in     renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.(CVE-2023-35828)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.(CVE-2023-4128)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 ('tun: tun_chr_open(): correctly initialize socket uid'), - 66b2c338adce ('tap: tap_open():
    correctly initialize socket uid'), pass 'inode-i_uid' to sock_init_data_uid() as the last parameter and     that turns out to not be accurate.(CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability.We recommend upgrading past commit     0323bce598eea038714f941ce2b22541c46d488f.(CVE-2023-3776)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.If tcf_change_indev() fails, u32_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability.We recommend upgrading past commit     04c55383fa5689357bcdd2c8036725a55ed632bc.(CVE-2023-3609)

    A flaw was found in the Linux kernels IP framework for transforming packets (XFRM subsystem). This     issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.(CVE-2023-3772)

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation.The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks.We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.(CVE-2023-3611)

    Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace(CVE-2023-35001)

    A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net     etfilter     f_tables_api.c.Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer     in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with     user access to cause a privilege escalation issue.We recommend upgrading past     commit1240eb93f0616b21c675416516ff3d74798fdc97.(CVE-2023-3390)

    A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernels IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%.(CVE-2023-1206)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec->tx_ready. (CVE-2023-1075)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

  - A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux     Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when     queue_event() fails. (CVE-2023-3159)

  - A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and     font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds     occurs leading to undefined behavior and possible denial of service. (CVE-2023-3161)

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue     could allow a local user to crash the system. (CVE-2023-3358)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem' access.
    (CVE-2023-34256)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c. (CVE-2023-35823)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in     drivers/media/pci/dm1105/dm1105.c. (CVE-2023-35824)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free.(CVE-2022-45886)

    In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.(CVE-2023-21255)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in     the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend     upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795.(CVE-2023-3610)

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64.(CVE-2023-3611)

    A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information.(CVE-2023-3567)

    Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace.(CVE-2023-35001)

    Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network     namespace.(CVE-2023-31248)

    bpf: Fix incorrect verifier pruning due to missing register precision taints(CVE-2023-2163)

    A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation.Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a     hrtimer.We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and0e388fce7aec40992eadee654193cad345d62663     for 5.15 stable).(CVE-2023-3389)

    A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c.Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue.We recommend upgrading past     commit1240eb93f0616b21c675416516ff3d74798fdc97.(CVE-2023-3390)

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in     drivers/media/pci/dm1105/dm1105.c.(CVE-2023-35824)

    A race condition was found in the Philips SAA7134 driver in the Linux kernel. In saa7134_initdev, dev-     video_q.timeout is eventually bound to saa7134_buffer_timeout. If we remove the module or device which     will call saa7134_finidev to cleanup, there may be unfinished work. This could lead to a use-after-free     issue.(CVE-2023-3327)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information.(CVE-2023-3268)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation.(CVE-2023-35788)

    A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel     panic.(CVE-2023-3212)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem'     access.(CVE-2023-34256)

    A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service problem.(CVE-2023-2985)

    A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system.(CVE-2023-2156)

    An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(fepriv-gt;sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(fepriv-gt;sem) may block the process.(CVE-2023-31084)

    In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the     drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually     an error pointer).(CVE-2023-22998)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit     0323bce598eea038714f941ce2b22541c46d488f.(CVE-2023-3776)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit     04c55383fa5689357bcdd2c8036725a55ed632bc.(CVE-2023-3609)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2871-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
    - CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
    - CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an     attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
    - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
    - CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause     system crashes (bsc#1207168).
    - CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
    - CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the     io_uring subcomponent (bsc#1207521).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
    - CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption     (bsc#1208600).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash     the system (bsc#1209039).
    - CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
    - CVE-2023-1583: Fixed a NULL pointer dereference in io_file_bitmap_get in io_uring/filetable.c     (bsc#1209637).
    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779).
    - CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul     in fs/nfsd/nfs4proc.c (bsc#1209788).
    - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could     use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a     local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).
    - CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
    - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
    - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
    - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands,     compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
    - CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-     wrapper.S (bsc#1212155).
    - CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c     (bsc#1211654).
    - CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c     in RDMA (bsc#1210629).
    - CVE-2023-2235: Fixed a use-after-free vulnerability in the Performance Events system that could have     been exploited to achieve local privilege escalation (bsc#1210986).
    - CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting     in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
    - CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
    - CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
    - CVE-2023-23001: Fixed misinterpretation of regulator_get return value in drivers/scsi/ufs/ufs-mediatek.c     (bsc#1208829).
    - CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
    - CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
    - CVE-2023-2430: Fixed a missing lock on overflow for IOPOLL (bsc#1211014).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
    - CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
    - CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
    - CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some     Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable     escalation of privilege via local access (bsc#1211263).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/uetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28866: Fixed an out-of-bounds access in net/bluetooth/hci_sync.c because amp_init1[] and     amp_init2[] are supposed to have an intentionally invalid element, but did not (bsc#1209780).
    - CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or     Spectre-BHB, for the new hw AmpereOne (bsc#1211855).
    - CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks     for CR0 and CR4 (bsc#1210294).
    - CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove     (bsc#1210329).
    - CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-3111: Fixed a use-after-free vulnerability in prepare_to_relocate in fs/btrfs/relocation.c     (bsc#1212051).
    - CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed     local attackers to crash the system at device disconnect (bsc#1212129).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
    - CVE-2023-3212: Fixed a NULL pointer dereference flaw in the gfs2 file system (bsc#1212265).
    - CVE-2023-3220: Fixed a NULL pointer dereference flaw in dpu_crtc_atomic_check in     drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() (bsc#1212556).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).
    - CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver     (bsc#1212606).
    - CVE-2023-3389: Fixed a use-after-free vulnerability in the io_uring subsystem (bsc#1212838).
    - CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the     vmwgfx driver (bsc#1211593).
    - CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the     vmwgfx driver (bsc#1211595).
    - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via     TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
    - CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
    - CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in     drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
    - CVE-2023-35829: Fixed a use-after-free flaw in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c     (bsc#1212495).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
189642	RHEL 8 : kernel (RHSA-2023:7539)	Nessus	Red Hat Local Security Checks	2024/1/26	2025/9/24	high
204343	Photon OS 5.0: Linux PHSA-2023-5.0-0046	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/21	critical
188798	EulerOS Virtualization 3.0.6.6 : kernel (EulerOS-SA-2023-3418)	Nessus	Huawei Local Security Checks	2024/1/16	2025/3/31	high
239807	TencentOS Server 3: kernel (TSSA-2024:0145)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/23	high
293251	MiracleLinux 7 : kernel-3.10.0-1160.119.1.0.4.el7.AXS7 (AXSA:2024-8903:32)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
173057	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2023-12207)	Nessus	Oracle Linux Local Security Checks	2023/3/21	2026/2/9	high
186528	AlmaLinux 8 : kernel (ALSA-2023:7549)	Nessus	Alma Linux Local Security Checks	2023/12/3	2024/8/9	high
177994	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2782-1)	Nessus	SuSE Local Security Checks	2023/7/5	2025/9/25	high
186633	Rocky Linux 8 : kernel (RLSA-2023:7549)	Nessus	Rocky Linux Local Security Checks	2023/12/6	2024/8/9	high
184097	Ubuntu 22.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-6466-1)	Nessus	Ubuntu Local Security Checks	2023/10/31	2025/9/24	critical
186369	RHEL 8 : kernel (RHSA-2023:7549)	Nessus	Red Hat Local Security Checks	2023/11/28	2024/11/7	high
186088	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2023-325-01)	Nessus	Slackware Local Security Checks	2023/11/21	2025/9/29	critical
188804	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2879)	Nessus	Huawei Local Security Checks	2024/1/16	2025/9/29	high
188867	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2023-2811)	Nessus	Huawei Local Security Checks	2024/1/16	2024/3/4	high
188934	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-2843)	Nessus	Huawei Local Security Checks	2024/1/16	2025/9/29	high
178457	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2871-1)	Nessus	SuSE Local Security Checks	2023/7/19	2025/9/25	high

检测

插件搜索

high

critical

high

high

high

high

high

high

high

critical

high

critical

high

high

high

high