The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0723 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    * kernel: drivers/usb/storage/ene_ub6250.c (CVE-2023-45862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0897 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0160-1 advisory.

  - Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an     unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without     knowledge of the PIN. (CVE-2020-26555)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system. (CVE-2023-6546)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6610)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0156-1 advisory.

  - Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an     unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without     knowledge of the PIN. (CVE-2020-26555)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system. (CVE-2023-6546)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6610)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0141-1 advisory.

  - Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an     unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without     knowledge of the PIN. (CVE-2020-26555)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system. (CVE-2023-6546)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6610)

  - A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1404 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (CVE-2021-43975)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * The kernel is still getting hung up even after converting kernfs_mutex to kernfs_rwsem with massive     concurrent kernfs access (open & lookup) performed by kubelet/node_exporter threads. (JIRA:RHEL-17149)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (JIRA:RHEL-18810)

    * kernel: tun: avoid double free in tun_free_netdev (JIRA:RHEL-18813)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (JIRA:RHEL-18850)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19461)

    * ipoib mcast lockup fix (JIRA:RHEL-19698)

    * kernel: denial of service in tipc_conn_close (JIRA:RHEL-18824)

    * Rhel-8.6 crash at  qed_get_current_link+0x11 during tx_timeout recovery  (JIRA:RHEL-20923)

    * kernel: use-after-free in sch_qfq network scheduler (JIRA:RHEL-14402)

    * RHEL8.6 - s390/qeth: NET2016 - fix use-after-free in HSCI (JIRA:RHEL-15849)

    * RHEL8.6 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17883)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-18582)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (JIRA:RHEL-18799)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (JIRA:RHEL-18814)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-18998)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19110)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19327)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19451)

    * [RHEL8] I/O blocked during fio background with IO schedule switch, cpu offline/online, pci nvme     rescan/reset (JIRA:RHEL-20231)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20298)

    * kernel: inactive elements in nft_pipapo_walk (JIRA:RHEL-20697)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (JIRA:RHEL-21661)

    * kernel NULL pointer at RIP: 0010:kyber_has_work+0x1c/0x60 (JIRA:RHEL-21784)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22090)

    * backport timerlat user-space support (JIRA:RHEL-20361)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
190105	RHEL 9 : kernel (RHSA-2024:0723)	Nessus	Red Hat Local Security Checks	2024/2/7	2024/11/7	high
190769	RHEL 8 : kernel (RHSA-2024:0897)	Nessus	Red Hat Local Security Checks	2024/2/20	2025/3/6	high
189207	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:0160-1)	Nessus	SuSE Local Security Checks	2024/1/19	2024/6/17	high
189211	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2024:0156-1)	Nessus	SuSE Local Security Checks	2024/1/19	2024/6/17	high
189213	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:0141-1)	Nessus	SuSE Local Security Checks	2024/1/19	2024/6/17	high
276407	TencentOS Server 4: kernel (TSSA-2025:0047)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
192277	RHEL 8 : kernel (RHSA-2024:1404)	Nessus	Red Hat Local Security Checks	2024/3/19	2025/8/18	high

检测

插件搜索

high

high

high

high

high

high

high