An update of the linux package has been released.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6681-1 advisory.

    Wenqing Liu discovered that the f2fs file system implementation in the Linux kernel did not properly     validate inode types while performing garbage collection. An attacker could use this to construct a     malicious f2fs image that, when mounted and operated on, could cause a denial of service (system crash).
    (CVE-2021-44879)

    It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly     handle certain error conditions during device registration. A local attacker could possibly use this to     cause a denial of service (system crash). (CVE-2023-22995)

    Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading     to a use-after-free vulnerability. A local user could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2023-4244)

    It was discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-51779)

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the Rose X.25 protocol implementation in the Linux     kernel, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-51782)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some     situations. A local attacker could use this to possibly expose sensitive information (kernel memory).
    (CVE-2024-0340)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6680-3 advisory.

     discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel did not     properly handle certain memory allocation failure conditions, leading to a null pointer dereference     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-46343)

    It was discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-51779)

    It was discovered that a race condition existed in the Rose X.25 protocol implementation in the Linux     kernel, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-51782)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    Jann Horn discovered that the io_uring subsystem in the Linux kernel contained an out-of-bounds access     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-6560)

    Dan Carpenter discovered that the netfilter subsystem in the Linux kernel did not store data in properly     sized memory locations. A local user could use this to cause a denial of service (system crash).
    (CVE-2024-0607)

    Supraja Sridhara, Benedict Schlter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the     Confidential Computing framework in the Linux kernel for x86 platforms did not properly handle 32-bit     emulation on TDX and SEV. An attacker with access to the VMM could use this to cause a denial of service     (guest crash) or possibly execute arbitrary code. (CVE-2024-25744)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6680-2 advisory.

     discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel did not     properly handle certain memory allocation failure conditions, leading to a null pointer dereference     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-46343)

    It was discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-51779)

    It was discovered that a race condition existed in the Rose X.25 protocol implementation in the Linux     kernel, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-51782)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    Jann Horn discovered that the io_uring subsystem in the Linux kernel contained an out-of-bounds access     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-6560)

    Dan Carpenter discovered that the netfilter subsystem in the Linux kernel did not store data in properly     sized memory locations. A local user could use this to cause a denial of service (system crash).
    (CVE-2024-0607)

    Supraja Sridhara, Benedict Schlter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the     Confidential Computing framework in the Linux kernel for x86 platforms did not properly handle 32-bit     emulation on TDX and SEV. An attacker with access to the VMM could use this to cause a denial of service     (guest crash) or possibly execute arbitrary code. (CVE-2024-25744)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0484-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been     exploited to achieve local privilege escalation (bsc#1219434).
    - CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
    - CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race     condition (bsc#1218730).
    - CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment     (bsc#1218836).
    - CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
    - CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code     inside the brcm80211 component (bsc#1216702).
    - CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a     driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
    - CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user     to cause an information leak problem while freeing the old quota file names before a potential failure     (bsc#1219053).
    - CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function     (bsc#1218752).
    - CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race     condition (bsc#1218757).
    - CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information     (bsc#1217946).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in     drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0483-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-1086: Fixed a use-after-free vulnerability inside the nf_tables component that could have been     exploited to achieve local privilege escalation (bsc#1219434).
    - CVE-2023-51780: Fixed a use-after-free in do_vcc_ioctl in net/atm/ioctl.c, because of a vcc_recvmsg race     condition (bsc#1218730).
    - CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment     (bsc#1218836).
    - CVE-2021-33631: Fixed an integer overflow in ext4_write_inline_data_end() (bsc#1219412).
    - CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code     inside the brcm80211 component (bsc#1216702).
    - CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a     driver unload in drivers/gpu/drm/drm_atomic.c (bsc#1219120).
    - CVE-2024-0775: Fixed use-after-free in __ext4_remount in fs/ext4/super.c that could allow a local user     to cause an information leak problem while freeing the old quota file names before a potential failure     (bsc#1219053).
    - CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function     (bsc#1218752).
    - CVE-2023-51782: Fixed use-after-free in rose_ioctl in net/rose/af_rose.c because of a rose_accept race     condition (bsc#1218757).
    - CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
    - CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in     drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
204109	Photon OS 3.0: Linux PHSA-2024-3.0-0713	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/1/6	high
191663	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6681-1)	Nessus	Ubuntu Local Security Checks	2024/3/7	2024/8/27	high
192293	Ubuntu 22.04 LTS / 23.10 : Linux kernel (AWS) vulnerabilities (USN-6680-3)	Nessus	Ubuntu Local Security Checks	2024/3/20	2024/9/9	high
191739	Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6680-2)	Nessus	Ubuntu Local Security Checks	2024/3/8	2024/9/9	high
190650	SUSE SLED12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2024:0484-1)	Nessus	SuSE Local Security Checks	2024/2/17	2026/6/25	high
190652	SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2024:0483-1)	Nessus	SuSE Local Security Checks	2024/2/17	2026/6/25	high

检测

插件搜索

high

high

high

high

high

high