The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3318-1 advisory.

    The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
    - CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
    - CVE-2023-20569: Fixed side channel attack Inception or RAS Poisoning (bsc#1213287).
    - CVE-2023-20593: Fixed a ZenBleed issue in 'Zen 2' CPUs that could allow an attacker to potentially     access sensitive information (bsc#1213286).
    - CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
    - CVE-2023-2985: Fixed an use-after-free vulnerability in hfsplus_put_super in fs/hfsplus/super.c that     could allow a local user to cause a denial of service (bsc#1211867).
    - CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
    - CVE-2023-3117: Fixed an use-after-free vulnerability in the netfilter subsystem when processing named     and anonymous sets in batch requests that could allow a local user with CAP_NET_ADMIN capability to crash     or potentially escalate their privileges on the system (bsc#1213245).
    - CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local     attacker to escalate their privilege (bsc#1213061).
    - CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs     (bsc#1212502).
    - CVE-2023-3390: Fixed an use-after-free vulnerability in the netfilter subsystem in     net/netfilter/nf_tables_api.c that could allow a local attacker with user access to cause a privilege     escalation issue (bsc#1212846).
    - CVE-2023-35001: Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local     attacker to escalate their privilege (bsc#1213059).
    - CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
    - CVE-2023-3609: Fixed reference counter leak leading to  overflow in net/sched (bsc#1213586).
    - CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
    - CVE-2023-3776: Fixed improper refcount update in  cls_fw leads to use-after-free (bsc#1213588).
    - CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that     could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543).
    - CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.228-131.415. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-041 advisory.

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

    Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC     interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It     appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol     headers are all contained within the linear section of the SKB and some NICs behave badly if this is not     the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x)     though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with     split headers, netback will forward those violating above mentioned assumption to the networking core,     resulting in said misbehavior. (CVE-2022-3643)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42328)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42329)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid use-after-free in ip6_fragment() (CVE-2022-48956)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netfront: Fix NULL sring after live migration (CVE-2022-48969)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Get user_ns from in_skb in unix_diag_get_exact(). (CVE-2022-48970)

    In the Linux kernel, the following vulnerability has been resolved:

    mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (CVE-2022-48972)

    In the Linux kernel, the following vulnerability has been resolved:

    can: af_can: fix NULL pointer dereference in can_rcv_filter (CVE-2022-48977)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix shift-out-of-bounds in hid_report_raw_event (CVE-2022-48978)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/shmem-helper: Remove errant put in error path (CVE-2022-48981)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/gup: fix gup_pud_range() for dax (CVE-2022-48986)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-dv-timings.c: fix too strict blanking sanity checks (CVE-2022-48987)

    In the Linux kernel, the following vulnerability has been resolved:

    memcg: fix possible use-after-free in memcg_write_event_control() (CVE-2022-48988)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (CVE-2022-48991)

    A null pointer dereference issue was found in the can protocol in net/can/af_can.c in the Linux Kernel.
    ml_priv may not be initialized in the receive path of CAN frames. This issue could allow a local user to     crash the system or cause a denial of service. (CVE-2023-2166)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004363 advisory.

    A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0439 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue (BZ#2230094)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

    * kernel: A heap out-of-bounds write (CVE-2023-5717)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0724 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * kernel: improper input validation may lead to privilege escalation (CVE-2021-4204)

    * kernel: memory leak for large arguments in video_usercopy function in     drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

    * kernel: eBPF verification flaw (CVE-2021-34866)

    * kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges     (CVE-2022-0500)

    * kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * kernel: possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    * kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

    * kernel: netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * kernel: memory leak in ipv6_renew_options() (CVE-2022-3524)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed     (CVE-2022-3707)

    * kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * kernel: local privileges escalation in kernel/bpf/verifier.c (CVE-2022-23222)

    * kernel: Executable Space Protection Bypass (CVE-2022-25265)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1367 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * kernel: out-of-bounds write in qfq_change_class function (JIRA:RHEL-12696)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18194)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20296)

    * kernel: inactive elements in nft_pipapo_walk (JIRA:RHEL-20695)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22088)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-18580)

    * ipoib mcast lockup fix (JIRA:RHEL-19696)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19108)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19325)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19449)

    * kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22763)

    * RHEL 8.5: Backport upstream memory cgroup commits up to v5.12 (JIRA:RHEL-9162)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19459)

    * ceph: several cap and snap fixes (JIRA:RHEL-20906)

    * kernel NULL pointer at RIP: 0010:kyber_has_work+0x1c/0x60 (JIRA:RHEL-21782)

    * rbd: don't move requests to the running list on errors [8.x] (JIRA:RHEL-24201)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4131-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
    - CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
    - CVE-2024-50208: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (bsc#1233117).
    - CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
    - CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
    - CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
    - CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
    - CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
    - CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
    - CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
    - CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).
    - CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
    - CVE-2024-45026: s390/dasd: fix error recovery leading to data corruption on ESE devices (bsc#1230454).
    - CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor     (bsc#1230715).
    - CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
    - CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
    - CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
    - CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links     (bsc#1231197).
    - CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6     (bsc#1231200).
    - CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
    - CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
    - CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
    - CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
    - CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
    - CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
    - CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition     (bsc#1232145).
    - CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
    - CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
    - CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
    - CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
    - CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
    - CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
    - CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
    - CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
    - CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
    - CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3377-1 advisory.

    The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' (bsc#1206418).
    - CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
    - CVE-2023-20569: Fixed side channel attack Inception or RAS Poisoning (bsc#1213287).
    - CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
    - CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
    - CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs     (bsc#1212502).
    - CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
    - CVE-2023-3776: Fixed improper refcount update in  cls_fw leads to use-after-free (bsc#1213588).
    - CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0897 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.162-141.675. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-025 advisory.

    A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

    Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC     interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It     appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol     headers are all contained within the linear section of the SKB and some NICs behave badly if this is not     the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x)     though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with     split headers, netback will forward those violating above mentioned assumption to the networking core,     resulting in said misbehavior. (CVE-2022-3643)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42328)

    Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42329)

    A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix preallocation discarding at indirect extent boundary (CVE-2022-48946)

    In the Linux kernel, the following vulnerability has been resolved:

    igb: Initialize mailbox message for VF reset (CVE-2022-48949)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: avoid use-after-free in ip6_fragment() (CVE-2022-48956)

    In the Linux kernel, the following vulnerability has been resolved:

    xen-netfront: Fix NULL sring after live migration (CVE-2022-48969)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Get user_ns from in_skb in unix_diag_get_exact(). (CVE-2022-48970)

    In the Linux kernel, the following vulnerability has been resolved:

    mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() (CVE-2022-48972)

    In the Linux kernel, the following vulnerability has been resolved:

    can: af_can: fix NULL pointer dereference in can_rcv_filter (CVE-2022-48977)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: fix shift-out-of-bounds in hid_report_raw_event (CVE-2022-48978)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/shmem-helper: Remove errant put in error path (CVE-2022-48981)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/gup: fix gup_pud_range() for dax (CVE-2022-48986)

    In the Linux kernel, the following vulnerability has been resolved:

    media: v4l2-dv-timings.c: fix too strict blanking sanity checks (CVE-2022-48987)

    In the Linux kernel, the following vulnerability has been resolved:

    memcg: fix possible use-after-free in memcg_write_event_control() (CVE-2022-48988)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (CVE-2022-48991)

    In the Linux kernel, the following vulnerability has been resolved:

    char: tpm: Protect tpm_pm_suspend with locks (CVE-2022-48997)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference (CVE-2022-48999)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in has_external_pci() (CVE-2022-49000)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() (CVE-2022-49002)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Free buffers when a used dynamic event is removed (CVE-2022-49006)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry() (CVE-2022-49007)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: fix memory leak in sctp_stream_outq_migrate() (CVE-2022-49013)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tun: Fix use-after-free in tun_detach() (CVE-2022-49014)

    In the Linux kernel, the following vulnerability has been resolved:

    net: hsr: Fix potential use-after-free (CVE-2022-49015)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: re-fetch skb cb after tipc_msg_validate (CVE-2022-49017)

    In the Linux kernel, the following vulnerability has been resolved:

    net: phy: fix null-ptr-deref while probe() failed (CVE-2022-49021)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix use-after-free when reverting termination table (CVE-2022-49025)

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix error handling in iavf_init_module() (CVE-2022-49027)

    In the Linux kernel, the following vulnerability has been resolved:

    ixgbevf: Fix resource leak in ixgbevf_init_module() (CVE-2022-49028)

    In the Linux kernel, the following vulnerability has been resolved:

    libbpf: Handle size overflow for ringbuf mmap (CVE-2022-49030)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (CVE-2022-49033)

    A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux     kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root.
    Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in     9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in     788d0824269bef539fe31a785b1517882eafed93. (CVE-2023-1295)

    A null pointer dereference issue was found in the can protocol in net/can/af_can.c in the Linux Kernel.
    ml_priv may not be initialized in the receive path of CAN frames. This issue could allow a local user to     crash the system or cause a denial of service. (CVE-2023-2166)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1306 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch     requests (CVE-2023-3390)

    * out-of-bounds access in relay_file_read (CVE-2023-3268)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (CVE-2023-38409)

    * Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue ()

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * use after free in unix_stream_sendpage (CVE-2023-4622)

    * bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its     child's sibling_list (CVE-2023-5717)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

    * use-after-free in IPv4 IGMP (CVE-2023-6932)

    * GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

    * refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (JIRA:RHEL-1107)

    * out-of-bounds access in relay_file_read (JIRA:RHEL-1749)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18085)

    * NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19524)

    * update RT source tree to the latest RHEL-9.0.z Batch 15 (JIRA:RHEL-21555)

    * Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-9285)

    * A heap out-of-bounds write (JIRA:RHEL-18011)

    * Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19398)

    * A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19534)

    * Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe (JIRA:RHEL-8980)

    * various flaws (JIRA:RHEL-16150)

    * refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20311)

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-20502)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (JIRA:RHEL-22095)

    * use-after-free in smb2_is_status_io_timeout() (JIRA:RHEL-15171)

    * use-after-free in IPv4 IGMP (JIRA:RHEL-21658)

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (JIRA:RHEL-8996)

    * GSM multiplexing race condition leads to privilege escalation (JIRA:RHEL-19968)

    * NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22751)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier     (JIRA:RHEL-26381)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1382 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead     (CVE-2023-3611)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

    * inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * out-of-bounds write in qfq_change_class function (JIRA:RHEL-12700)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18192)

    * refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20302)

    * inactive elements in nft_pipapo_walk (JIRA:RHEL-20703)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (JIRA:RHEL-22099)

    * update RT source tree to the latest RHEL-8.4.z Batch 23 (JIRA:RHEL-23825)

    * null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-19023)

    * Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19404)

    * A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19530)

    * vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22755)

    * NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19520)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1404 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (CVE-2021-43975)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * The kernel is still getting hung up even after converting kernfs_mutex to kernfs_rwsem with massive     concurrent kernfs access (open & lookup) performed by kubelet/node_exporter threads. (JIRA:RHEL-17149)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (JIRA:RHEL-18810)

    * kernel: tun: avoid double free in tun_free_netdev (JIRA:RHEL-18813)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (JIRA:RHEL-18850)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19461)

    * ipoib mcast lockup fix (JIRA:RHEL-19698)

    * kernel: denial of service in tipc_conn_close (JIRA:RHEL-18824)

    * Rhel-8.6 crash at  qed_get_current_link+0x11 during tx_timeout recovery  (JIRA:RHEL-20923)

    * kernel: use-after-free in sch_qfq network scheduler (JIRA:RHEL-14402)

    * RHEL8.6 - s390/qeth: NET2016 - fix use-after-free in HSCI (JIRA:RHEL-15849)

    * RHEL8.6 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17883)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-18582)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (JIRA:RHEL-18799)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (JIRA:RHEL-18814)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-18998)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19110)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19327)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19451)

    * [RHEL8] I/O blocked during fio background with IO schedule switch, cpu offline/online, pci nvme     rescan/reset (JIRA:RHEL-20231)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20298)

    * kernel: inactive elements in nft_pipapo_walk (JIRA:RHEL-20697)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (JIRA:RHEL-21661)

    * kernel NULL pointer at RIP: 0010:kyber_has_work+0x1c/0x60 (JIRA:RHEL-21784)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22090)

    * backport timerlat user-space support (JIRA:RHEL-20361)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
179882	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2023:3318-1)	Nessus	SuSE Local Security Checks	2023/8/16	2026/6/26	high
170471	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-041)	Nessus	Amazon Linux Local Security Checks	2023/1/24	2026/2/26	high
288130	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004363)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/17	medium
189572	RHEL 9 : kernel-rt (RHSA-2024:0439)	Nessus	Red Hat Local Security Checks	2024/1/25	2025/8/15	high
190110	RHEL 8 : kernel (RHSA-2024:0724)	Nessus	Red Hat Local Security Checks	2024/2/7	2025/9/25	high
192229	RHEL 8 : kernel (RHSA-2024:1367)	Nessus	Red Hat Local Security Checks	2024/3/19	2025/3/6	high
212537	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:4131-1)	Nessus	SuSE Local Security Checks	2024/12/12	2026/6/26	high
180042	SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2023:3377-1)	Nessus	SuSE Local Security Checks	2023/8/23	2026/6/26	high
190769	RHEL 8 : kernel (RHSA-2024:0897)	Nessus	Red Hat Local Security Checks	2024/2/20	2025/3/6	high
170472	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-025)	Nessus	Amazon Linux Local Security Checks	2023/1/24	2026/2/26	high
192035	RHEL 9 : kernel-rt (RHSA-2024:1306)	Nessus	Red Hat Local Security Checks	2024/3/13	2025/3/6	critical
192263	RHEL 8 : kernel-rt (RHSA-2024:1382)	Nessus	Red Hat Local Security Checks	2024/3/19	2025/3/6	high
192277	RHEL 8 : kernel (RHSA-2024:1404)	Nessus	Red Hat Local Security Checks	2024/3/19	2025/8/18	high

检测

插件搜索

high

high

medium

high

high

high

high

high

high

high

critical

high

high