The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001691 advisory.

    usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0724 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * kernel: improper input validation may lead to privilege escalation (CVE-2021-4204)

    * kernel: memory leak for large arguments in video_usercopy function in     drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

    * kernel: eBPF verification flaw (CVE-2021-34866)

    * kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges     (CVE-2022-0500)

    * kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * kernel: possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    * kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

    * kernel: netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * kernel: memory leak in ipv6_renew_options() (CVE-2022-3524)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed     (CVE-2022-3707)

    * kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * kernel: local privileges escalation in kernel/bpf/verifier.c (CVE-2022-23222)

    * kernel: Executable Space Protection Bypass (CVE-2022-25265)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7313:32 advisory.

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)
      * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128,     CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)
      * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)
      * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975)
      * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)
      * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640)
      * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388)
      * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951,     CVE-2023-33952)
      * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)
      * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895)
      * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456)
      * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887)
      * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458)
      * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590)
      * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)
      * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073)
      * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)
      * kernel: hid: Use After Free in asus_remove (CVE-2023-1079)
      * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118)
      * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)
      * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)
      * kernel: denial of service in tipc_conn_close (CVE-2023-1382)
      * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)
      * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998)
      * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513)
      * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161)
      * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)
      * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772)
      * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132)
      * kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732)
      * Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455)
      * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)
      * kernel: Denial of service issue in az6027 driver (CVE-2023-28328)
      * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)
      * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)
      * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203)
      * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823)
      * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824)
      * kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825)
      * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)
      * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)
      * kernel: Use after free bug in r592_remove (CVE-2023-3141)
      * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.38 / 5.15.38_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-129-01 advisory.

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2022-0500)

  - Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making     it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit     2d3916f3189172d5c69d33065c3c21119fe539fc. (CVE-2022-0742)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - An out-of-bounds (OOB) memory write flaw was found in the Linux kernel's watch_queue event notification     subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain     privileged access or cause a denial of service on the system. (CVE-2022-0995)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
    (CVE-2022-24958)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2148 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * lockdown bypass using IMA (CVE-2022-21505)

    * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * denial of service in tipc_conn_close (CVE-2023-1382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2458 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * lockdown bypass using IMA (CVE-2022-21505)

    * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * denial of service in tipc_conn_close (CVE-2023-1382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2458 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A use-after-free flaw was found in the Linux kernel's pipes functionality in how a user performs     manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1882)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the     identifier assigned to this vulnerability. (CVE-2022-3619)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges. (CVE-2022-3628)

  - A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function     l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads     to use after free. It is recommended to apply a patch to fix this issue. The identifier of this     vulnerability is VDB-211944. (CVE-2022-3640)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing     the subflow list at disconnect time. A local user could use this flaw to potentially crash the system     causing a denial of service. (CVE-2022-4128)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)     (CVE-2022-21505)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2148 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A use-after-free flaw was found in the Linux kernel's pipes functionality in how a user performs     manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1882)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the     identifier assigned to this vulnerability. (CVE-2022-3619)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges. (CVE-2022-3628)

  - A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function     l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads     to use after free. It is recommended to apply a patch to fix this issue. The identifier of this     vulnerability is VDB-211944. (CVE-2022-3640)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing     the subflow list at disconnect time. A local user could use this flaw to potentially crash the system     causing a denial of service. (CVE-2022-4128)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)     (CVE-2022-21505)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2023:1683229770 advisory.

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5173 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2021-4197 Eric Biederman reported that incorrect permission     checks in the cgroup process migration implementation can allow a local attacker to escalate privileges.
    CVE-2022-0494 The scsi_ioctl() was susceptible to an information leak only exploitable by users with     CAP_SYS_ADMIN or CAP_SYS_RAWIO capabilities. CVE-2022-0812 It was discovered that the RDMA transport for     NFS (xprtrdma) miscalculated the size of message headers, which could lead to a leak of sensitive     information between NFS servers and clients. CVE-2022-0854 Ali Haider discovered a potential information     leak in the DMA subsystem. On systems where the swiotlb feature is needed, this might allow a local user     to read sensitive information. CVE-2022-1011 Jann Horn discovered a flaw in the FUSE (Filesystem in User-     Space) implementation. A local user permitted to mount FUSE filesystems could exploit this to cause a use-     after-free and read sensitive information. CVE-2022-1012, CVE-2022-32296 Moshe Kol, Amit Klein, and Yossi     Gilad discovered a weakness in randomisation of TCP source port selection. CVE-2022-1016 David Bouman     discovered a flaw in the netfilter subsystem where the nft_do_chain function did not initialize register     data that nf_tables expressions can read from and write to. A local attacker can take advantage of this to     read sensitive information. CVE-2022-1048 Hu Jiahui discovered a race condition in the sound subsystem     that can result in a use-after-free. A local user permitted to access a PCM sound device can take     advantage of this flaw to crash the system or potentially for privilege escalation. CVE-2022-1184 A flaw     was discovered in the ext4 filesystem driver which can lead to a use-after-free. A local user permitted to     mount arbitrary filesystems could exploit this to cause a denial of service (crash or memory corruption)     or possibly for privilege escalation. CVE-2022-1195 Lin Ma discovered race conditions in the 6pack and     mkiss hamradio drivers, which could lead to a use-after-free. A local user could exploit these to cause a     denial of service (memory corruption or crash) or possibly for privilege escalation. CVE-2022-1198 Duoming     Zhou discovered a race condition in the 6pack hamradio driver, which could lead to a use-after-free. A     local user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2022-1199, CVE-2022-1204, CVE-2022-1205 Duoming Zhou discovered race conditions     in the AX.25 hamradio protocol, which could lead to a use-after-free or null pointer dereference. A local     user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2022-1353 The TCS Robot tool found an information leak in the PF_KEY subsystem.
    A local user can receive a netlink message when an IPsec daemon registers with the kernel, and this could     include sensitive information. CVE-2022-1419 Minh Yuan discovered a race condition in the vgem virtual GPU     driver that can lead to a use-after-free. A local user permitted to access the GPU device can exploit this     to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2022-1516 A NULL pointer dereference flaw in the implementation of the X.25 set of standardized     network protocols, which can result in denial of service. This driver is not enabled in Debian's official     kernel configurations. CVE-2022-1652 Minh Yuan discovered a race condition in the floppy driver that can     lead to a use-after-free. A local user permitted to access a floppy drive device can exploit this to cause     a denial of service (crash or memory corruption) or possibly for privilege escalation. CVE-2022-1729     Norbert Slusarek discovered a race condition in the perf subsystem which could result in local privilege     escalation to root. The default settings in Debian prevent exploitation unless more permissive settings     have been applied in the kernel.perf_event_paranoid sysctl. CVE-2022-1734 Duoming Zhou discovered race     conditions in the nfcmrvl NFC driver that could lead to a use-after-free, double-free or null pointer     dereference. A local user might be able to exploit these for denial of service (crash or memory     corruption) or possibly for privilege escalation. This driver is not enabled in Debian's official kernel     configurations. CVE-2022-1974, CVE-2022-1975 Duoming Zhou discovered that the NFC netlink interface was     suspectible to denial of service. CVE-2022-2153 kangel reported a flaw in the KVM implementation for x86     processors which could lead to a null pointer dereference. A local user permitted to access /dev/kvm could     exploit this to cause a denial of service (crash). CVE-2022-21123, CVE-2022-21125, CVE-2022-21166 Various     researchers discovered flaws in Intel x86 processors, collectively referred to as MMIO Stale Data     vulnerabilities. These are similar to the previously published Microarchitectural Data Sampling (MDS)     issues and could be exploited by local users to leak sensitive information. For some CPUs, the mitigations     for these issues require updated microcode. An updated intel-microcode package may be provided at a later     date. The updated CPU microcode may also be available as part of a system firmware (BIOS) update.
    Further information on the mitigation can be found at https://www.kernel.org/doc/html/latest/admin-     guide/hw-vuln/processor_mmio_stale_data.html or in the linux-doc-4.19 package. CVE-2022-23960 Researchers     at VUSec discovered that the Branch History Buffer in Arm processors can be exploited to create     information side channels with speculative execution. This issue is similar to Spectre variant 2, but     requires additional mitigations on some processors. This was previously mitigated for 32-bit Arm (armel     and armhf) architectures and is now also mitigated for 64-bit Arm (arm64). This can be exploited to obtain     sensitive information from a different security context, such as from user-space to the kernel, or from a     KVM guest to the kernel. CVE-2022-26490 Buffer overflows in the STMicroelectronics ST21NFCA core driver     can result in denial of service or privilege escalation. This driver is not enabled in Debian's official     kernel configurations. CVE-2022-27666 valis reported a possible buffer overflow in the IPsec ESP     transformation code. A local user can take advantage of this flaw to cause a denial of service or for     privilege escalation. CVE-2022-28356 Beraphin discovered that the ANSI/IEEE 802.2 LLC type 2 driver did     not properly perform reference counting on some error paths. A local attacker can take advantage of this     flaw to cause a denial of service. CVE-2022-28388 A double free vulnerability was discovered in the 8     devices USB2CAN interface driver. CVE-2022-28389 A double free vulnerability was discovered in the     Microchip CAN BUS Analyzer interface driver. CVE-2022-28390 A double free vulnerability was discovered in     the EMS CPC-USB/ARM7 CAN/USB interface driver. CVE-2022-29581 Kyle Zeng discovered a reference-counting     bug in the cls_u32 network classifier which can lead to a use-after-free. A local user can exploit this to     cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2022-30594 Jann Horn discovered a flaw in the interaction between ptrace and seccomp subsystems. A     process sandboxed using seccomp() but still permitted to use ptrace() could exploit this to remove the     seccomp restrictions. CVE-2022-32250 Aaron Adams discovered a use-after-free in Netfilter which may result     in local privilege escalation to root. CVE-2022-33981 Yuan Ming from Tsinghua University reported a race     condition in the floppy driver involving use of the FDRAWCMD ioctl, which could lead to a use-after-free.
    A local user with access to a floppy drive device could exploit this to cause a denial of service (crash     or memory corruption) or possibly for privilege escalation. This ioctl is now disabled by default. For the     oldstable distribution (buster), these problems have been fixed in version 4.19.249-2. Due to an issue in     the signing service (Cf. Debian bug #1012741), the vport-vxlan module cannot be loaded for the signed     kernel for amd64 in this update. This update also corrects a regression in the network scheduler subsystem     (bug #1013299). For the 32-bit Arm (armel and armhf) architectures, this update enables optimised     implementations of several cryptographic and CRC algorithms. For at least AES, this should remove a timing     sidechannel that could lead to a leak of sensitive information. This update includes many more bug fixes     from stable updates 4.19.236-4.19.249 inclusive, including for bug #1006346. The random driver has been     backported from Linux 5.19, fixing numerous performance and correctness issues. Some changes will be     visible: The entropy pool size is now 256 bits instead of 4096. You may need to adjust the configuration     of system monitoring or user-space entropy gathering services to allow for this. On systems without a     hardware RNG, the kernel may log more uses of /dev/urandom before it is fully initialised. These uses were     previously under-counted and this is not a regression. We recommend that you upgrade your linux packages.
    For the detailed security status of linux please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284606	Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001691)	Nessus	Unity Linux Local Security Checks	2026/1/14	2026/1/14	medium
190110	RHEL 8 : kernel (RHSA-2024:0724)	Nessus	Red Hat Local Security Checks	2024/2/7	2025/9/25	high
292841	MiracleLinux 8 : kernel-4.18.0-513.5.1.el8_9 (AXSA:2023-7313:32)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
160874	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2022-129-01)	Nessus	Slackware Local Security Checks	2022/5/10	2026/10/9	high
175460	RHEL 9 : kernel-rt (RHSA-2023:2148)	Nessus	Red Hat Local Security Checks	2023/5/13	2025/9/10	high
175477	RHEL 9 : kernel (RHSA-2023:2458)	Nessus	Red Hat Local Security Checks	2023/5/13	2025/9/10	high
175604	AlmaLinux 9 : kernel (ALSA-2023:2458)	Nessus	Alma Linux Local Security Checks	2023/5/14	2024/1/16	high
175629	AlmaLinux 9 : kernel-rt (ALSA-2023:2148)	Nessus	Alma Linux Local Security Checks	2023/5/14	2024/1/16	high
366948	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2023:1683229770)	Nessus	CentOS Local Security Checks	2026/10/18	2026/10/19	high
162703	Debian DSA-5173-1 : linux - security update	Nessus	Debian Local Security Checks	2022/7/4	2025/1/24	high

检测

插件搜索

medium

high

high

high

high

high

high

high

high

high