The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6702-2 advisory.

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that the ARM Mali Display Processor driver implementation in the Linux kernel did not     properly handle certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2023-23004)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6704-2 advisory.

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly handle     session setup requests. A remote attacker could possibly use this to cause a denial of service (memory     exhaustion). (CVE-2023-32247)

    Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element     deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1085)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6700-2 advisory.

    It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation in the Linux kernel contained     a race condition when releasing PPPoL2TP sockets in certain conditions, leading to a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2022-20567)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-4 advisory.

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could     potentially use this to expose sensitive information. (CVE-2023-3006)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0017 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-20588:
    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality.

    CVE-2023-28464:
    hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation.

    CVE-2023-39192:
    A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure.

    CVE-2023-45863:
    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

    CVE-2023-45871:
    An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.

    CVE-2023-4622:
    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.
    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.
    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

    CVE-2023-51779:
    bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free     because of a bt_sock_ioctl race condition.

    CVE-2023-5178:
    A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause     a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation.

    CVE-2023-52438:
    In the Linux kernel, the following vulnerability has been resolved:
    binder: fix use-after-free in shinker's callback     The mmap read lock is used during the shrinker's callback, which means     that using alloc->vma pointer isn't safe as it can race with munmap().
    As of commit dd2283f2605e (mm: mmap: zap pages with read mmap_sem in     munmap) the mmap lock is downgraded after the vma has been isolated.
    I was able to reproduce this issue by manually adding some delays and     triggering page reclaiming through the shrinker's debug sysfs. The     following KASAN report confirms the UAF:
    ==================================================================     BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8     Read of size 8 at addr ffff356ed50e50f0 by task bash/478     CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70     Hardware name: linux,dummy-virt (DT)     Call trace:
    zap_page_range_single+0x470/0x4b8     binder_alloc_free_page+0x608/0xadc
    __list_lru_walk_one+0x130/0x3b0     list_lru_walk_node+0xc4/0x22c     binder_shrink_scan+0x108/0x1dc     shrinker_debugfs_scan_write+0x2b4/0x500     full_proxy_write+0xd4/0x140     vfs_write+0x1ac/0x758     ksys_write+0xf0/0x1dc
    __arm64_sys_write+0x6c/0x9c     Allocated by task 492:
    kmem_cache_alloc+0x130/0x368     vm_area_alloc+0x2c/0x190     mmap_region+0x258/0x18bc     do_mmap+0x694/0xa60     vm_mmap_pgoff+0x170/0x29c     ksys_mmap_pgoff+0x290/0x3a0
    __arm64_sys_mmap+0xcc/0x144     Freed by task 491:
    kmem_cache_free+0x17c/0x3c8     vm_area_free_rcu_cb+0x74/0x98     rcu_core+0xa38/0x26d4     rcu_core_si+0x10/0x1c
    __do_softirq+0x2fc/0xd24     Last potentially related work creation:
    __call_rcu_common.constprop.0+0x6c/0xba0     call_rcu+0x10/0x1c     vm_area_free+0x18/0x24     remove_vma+0xe4/0x118     do_vmi_align_munmap.isra.0+0x718/0xb5c     do_vmi_munmap+0xdc/0x1fc
    __vm_munmap+0x10c/0x278
    __arm64_sys_munmap+0x58/0x7c     Fix this issue by performing instead a vma_lookup() which will fail to     find the vma that was isolated before the mmap lock downgrade. Note that     this option has better performance than upgrading to a mmap write lock     which would increase contention. Plus, mmap_write_trylock() has been     recently removed anyway.

    CVE-2023-5717:
    A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation.
    If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it     can increment or write to memory locations outside of the allocated buffer.
    We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

    CVE-2023-6176:
    A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm     scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific     socket configuration, which could allow a local user to crash the system or escalate their privileges on     the system.

    CVE-2023-6931:
    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.
    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().
    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

    CVE-2023-6932:
    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.
    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.
    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

    CVE-2024-1086:
    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.
    The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence     the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error     which resembles NF_ACCEPT.
    We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    CVE-2024-22099:
    NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth     modules) allows Overflow Buffers. This vulnerability is associated with program files     /net/bluetooth/rfcomm/core.C.
    This issue affects Linux kernel: v2.6.12-rc2.

    CVE-2024-24855:
    A race condition was found in the Linux kernel's scsi device driver in lpfc_unregister_fcf_rescan()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue.

    CVE-2024-24860:
    A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set()     function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or     denial of service issue.

    CVE-2024-26597:
    In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob     in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-     bounds read when parsing the netlink attributes. See bug trace below:
    ==================================================================     BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline]     BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at     addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N     6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call     Trace: < TASK > __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106     print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395     kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline]
    __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697     nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880     net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70     net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel     net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345     netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline]     sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482
    ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64     arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80     entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3     e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246     ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX:
    0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000     R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13:
    00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 < /TASK > The buggy address belongs to the     variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c     refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags:
    0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8     0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped     because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9     00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9     >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00     00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According     to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence     use `IFLA_RMNET_MAX` here.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
192319	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6702-2)	Nessus	Ubuntu Local Security Checks	2024/3/20	2024/8/27	high
192398	Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-6704-2)	Nessus	Ubuntu Local Security Checks	2024/3/21	2024/8/27	high
192411	Ubuntu 16.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6700-2)	Nessus	Ubuntu Local Security Checks	2024/3/21	2024/8/27	high
193083	Ubuntu 14.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6701-4)	Nessus	Ubuntu Local Security Checks	2024/4/9	2024/9/18	critical
235960	Alibaba Cloud Linux 3 : 0017: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2024:0017)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
236061	Alibaba Cloud Linux 3 : 0149: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2024:0149)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical

检测

插件搜索

high

high

high

critical

high

critical