The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3897-1 advisory.

    The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bnc#1198702).
    - CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to     cause DoS (bnc#1200788).
    - CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686     bsc#1196018).
    - CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege     escalation or DoS (bnc#1202700).
    - CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET     and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
    - CVE-2022-3176: Fixed use-after-free in io_uring when using POLLFREE (bnc#1203391).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
    - CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bnc#1204402).
    - CVE-2022-3545: Fixed use-after-free in area_cache_get() in     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
    - CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local     privilege escalation or DoS (bnc#1204470).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bnc#1204439).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bnc#1204574).
    - CVE-2022-3623: Fixed race condition in follow_page_pte() (mm/gup.c) (bsc#1204575).
    - CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c     (bnc#1204637).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
    - CVE-2022-39189: Fixed a flaw in the x86 KVM subsystem that could allow unprivileged guest users to     compromise the guest kernel via TLB flush operations on preempted vCPU (bnc#1203066).
    - CVE-2022-40768: Fixed information disclosure in stex_queuecommand_lck (bnc#1203514).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
    - CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
    - CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)
    - CVE-2022-42721: Avoid nontransmitted BSS list corruption. (bsc#1204060)
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bnc#1204653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2951 advisory.

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087. (CVE-2022-3564)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges. (CVE-2022-3628)

  - In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were     built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of     bytes located in supposedly non-executable regions of a file. (CVE-2022-25265)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux     kernel. The issue occurs when it forgets to set the free pointer server->hostname to NULL, leading to an     invalid pointer request. (CVE-2023-1195)

  - A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.
    This issue may allow a local attacker with user privilege to cause a denial of service. (CVE-2023-1582)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the     identifier assigned to this vulnerability. (CVE-2022-3619)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5693-1 advisory.

    David Bouman and Billy Jheng Bing Jhong discovered that a race condition existed in the io_uring subsystem     in the Linux kernel, leading to a use- after-free vulnerability. A local attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2602)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Hao Sun and Jiacheng Xu discovered that the NILFS file system implementation in the Linux kernel contained     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-2978)

    Abhishek Shah discovered a race condition in the PF_KEYv2 implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information (kernel memory). (CVE-2022-3028)

    Xingyuan Mo and Gengjia Chen discovered that the Promise SuperTrak EX storage controller driver in the     Linux kernel did not properly handle certain structures. A local attacker could potentially use this to     expose sensitive information (kernel memory). (CVE-2022-40768)

    Snke Huster discovered that an integer overflow vulnerability existed in the WiFi driver stack in the     Linux kernel, leading to a buffer overflow. A physically proximate attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41674)

    Snke Huster discovered that a use-after-free vulnerability existed in the WiFi driver stack in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-42719)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly perform reference     counting in some situations, leading to a use-after-free vulnerability. A physically proximate attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2022-42720)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly handle BSSID/SSID     lists in some situations. A physically proximate attacker could use this to cause a denial of service     (infinite loop). (CVE-2022-42721)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel contained a NULL pointer     dereference vulnerability in certain situations. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2022-42722)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0153 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-47929:
      In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c.

      CVE-2023-0386:
      A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with     capabilities was found in the Linux kernels OverlayFS subsystem in how a user copies a capable file     from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their     privileges on the system.

      CVE-2023-1380:
      A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur     when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading     to a denial of service.

      CVE-2023-26545:
      In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation     failure (for registering the sysctl table under a new location) during the renaming of a device.

      CVE-2023-32233:
      In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch     requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local     users can obtain root privileges. This occurs because anonymous sets are mishandled.

      CVE-2021-3759:
      A memory overflow vulnerability was found in the Linux kernels ipc functionality of the memcg     subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw     allows a local user to starve the resources, causing a denial of service. The highest threat from this     vulnerability is to system availability.

      CVE-2022-2663:
      An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused     and incorrectly matches the message. A firewall may be able to be bypassed when users are using     unencrypted IRC with nf_conntrack_irc configured.

      CVE-2022-2905:
      An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data.

      CVE-2022-3028:
      A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket.

      CVE-2022-3061:
      Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error.

      CVE-2022-3169:
      A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive     request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver,     resulting in a PCIe link disconnect.

      CVE-2022-3303:
      A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could     lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root     or member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition

      CVE-2022-3521:
      A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier     assigned to this vulnerability.

      CVE-2022-3534:
      A vulnerability classified as critical has been found in Linux Kernel. Affected is the function     btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to     use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability     is VDB-211032.

      CVE-2022-40307:
      An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free.

      CVE-2022-40768:
      drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive     information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.

      CVE-2022-41674:
      An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.

      CVE-2022-42720:
      Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code.

      CVE-2022-42721:
      A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x     before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and,     in turn, potentially execute code.

      CVE-2022-42895:
      There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's     l2cap_parse_conf_req function which can be used to leak kernel pointers remotely.
      We recommend upgrading past commit     https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e     https://www.google.com/url

      CVE-2022-45934:
      An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in     net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets.

      CVE-2022-4662:
      A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user     attaches usb device. A local user could use this flaw to crash the system.

      CVE-2022-47520:
      An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in     drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds     read when parsing a Robust Security Network (RSN) information element from a Netlink packet.

      CVE-2023-1074:
      A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may     occur when a user starts a malicious networking service and someone connects to this service. This could     allow a local user to starve resources, causing a denial of service.

      CVE-2023-1076:
      A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters.

      CVE-2023-1095:
      In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free     the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a     list -- the list head is all zeroes, this results in a NULL pointer dereference.

      CVE-2023-1118:
      A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in     the way user detaching rc device. A local user could use this flaw to crash the system or potentially     escalate their privileges on the system.

      CVE-2023-1281:
      Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root.
      This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.

      CVE-2023-23000:
      In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node     return value. Callers expect NULL in the error case, but an error pointer is used.

      CVE-2023-23004:
      In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table     return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

      CVE-2023-23454:
      cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results).

      CVE-2023-23455:
      atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a     denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT     condition rather than valid classification results).

      CVE-2023-23559:
      In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an     integer overflow in an addition.

      CVE-2022-2978:
      A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function     security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use     this flaw to crash the system or potentially escalate their privileges on the system.

      CVE-2022-3621:
      A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the     function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The     manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is     recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920.

      CVE-2022-3625:
      A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability.

      CVE-2022-3629:
      A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability     affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory     leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this     vulnerability.

      CVE-2022-3646:
      A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects     the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The     manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a     patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability.

      CVE-2022-3649:
      A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the     function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use     after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this     issue. The identifier of this vulnerability is VDB-211992.

      CVE-2022-0435:
      A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user     sends a packet with malicious content where the number of domain member nodes is higher than the 64     allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they     have access to the TIPC network.

      CVE-2022-1016:
      A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker.

      CVE-2022-32250:
      net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free.

      CVE-2021-45095:
      pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.

      CVE-2022-1055:
      A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5

      CVE-2022-1353:
      A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information.

      CVE-2022-20154:
      In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could     lead to local escalation of privilege with System execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References:
    Upstream kernel

      CVE-2022-28356:
      In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2458 advisory.

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function     l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads     to use after free. It is recommended to apply a patch to fix this issue. The identifier of this     vulnerability is VDB-211944. (CVE-2022-3640)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges. (CVE-2022-3628)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - A use-after-free flaw was found in the Linux kernel's pipes functionality in how a user performs     manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1882)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the     identifier assigned to this vulnerability. (CVE-2022-3619)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)     (CVE-2022-21505)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing     the subflow list at disconnect time. A local user could use this flaw to potentially crash the system     causing a denial of service. (CVE-2022-4128)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3605-1 advisory.

    This update for the Linux Kernel 5.14.21-150400_24_18 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-41674: Fixed buffer overflow that can be triggered by injected WLAN frames (bsc#1203994).
    - CVE-2022-42719: Fixed use-after-free in the mac80211 stack when parsing a multi-BSSID element     (bsc#1204292).
    - CVE-2022-42720: Fixed refcounting bugs in the multi-BSS handling of the mac80211 stack (bsc#1204291).
    - CVE-2022-42721: Fixed list management bug in BSS handling of the mac80211 stack (bsc#1204290).
    - CVE-2022-39189: Fixed mishandled TLB flush operation in certain KVM_VCPU_PREEMPTED situations     (bsc#1203067).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5257 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2021-4037 Christian Brauner reported that the inode_init_owner     function for the XFS filesystem in the Linux kernel allows local users to create files with an unintended     group ownership allowing attackers to escalate privileges by making a plain file executable and SGID.
    CVE-2022-0171 Mingwei Zhang reported that a cache incoherence issue in the SEV API in the KVM subsystem     may result in denial of service. CVE-2022-1184 A flaw was discovered in the ext4 filesystem driver which     can lead to a use-after-free. A local user permitted to mount arbitrary filesystems could exploit this to     cause a denial of service (crash or memory corruption) or possibly for privilege escalation. CVE-2022-2602     A race between handling an io_uring request and the Unix socket garbage collector was discovered. An     attacker can take advantage of this flaw for local privilege escalation. CVE-2022-2663 David Leadbeater     reported flaws in the nf_conntrack_irc connection-tracking protocol module. When this module is enabled on     a firewall, an external user on the same IRC network as an internal user could exploit its lax parsing to     open arbitrary TCP ports in the firewall, to reveal their public IP address, or to block their IRC     connection at the firewall. CVE-2022-3061 A flaw was discovered in the i740 driver which may result in     denial of service. This driver is not enabled in Debian's official kernel configurations. CVE-2022-3176 A     use-after-free flaw was discovered in the io_uring subsystem which may result in local privilege     escalation to root. CVE-2022-3303 A race condition in the snd_pcm_oss_sync function in the sound subsystem     in the Linux kernel due to improper locking may result in denial of service. CVE-2022-20421 A use-after-     free vulnerability was discovered in the binder_inc_ref_for_node function in the Android binder driver. On     systems where the binder driver is loaded, a local user could exploit this for privilege escalation.
    CVE-2022-39188 Jann Horn reported a race condition in the kernel's handling of unmapping of certain memory     ranges. When a driver created a memory mapping with the VM_PFNMAP flag, which many GPU drivers do, the     memory mapping could be removed and freed before it was flushed from the CPU TLBs. This could result in a     page use-after-free. A local user with access to such a device could exploit this to cause a denial of     service (crash or memory corruption) or possibly for privilege escalation. CVE-2022-39842 An integer     overflow was discovered in the pxa3xx-gcu video driver which could lead to a heap out-of-bounds write.
    This driver is not enabled in Debian's official kernel configurations. CVE-2022-40307 A race condition was     discovered in the EFI capsule-loader driver, which could lead to use-after-free. A local user permitted to     access this device (/dev/efi_capsule_loader) could exploit this to cause a denial of service (crash or     memory corruption) or possibly for privilege escalation. However, this device is normally only accessible     by the root user. CVE-2022-41674, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721, CVE-2022-42722 Soenke     Huster discovered several vulnerabilities in the mac80211 subsystem triggered by WLAN frames which may     result in denial of service or the execution or arbitrary code. For the stable distribution (bullseye),     these problems have been fixed in version 5.10.149-1. We recommend that you upgrade your linux packages.
    For the detailed security status of linux please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3648-1 advisory.

    This update for the Linux Kernel 5.3.18-150200_24_112 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-41674: Fixed buffer overflow that can be triggered by injected WLAN frames (bsc#1203994).
    - CVE-2022-42719: Fixed use-after-free in the mac80211 stack when parsing a multi-BSSID element     (bsc#1204292).
    - CVE-2022-42720: Fixed refcounting bugs in the multi-BSS handling of the mac80211 stack (bsc#1204291).
    - CVE-2022-42721: Fixed list management bug in BSS handling of the mac80211 stack (bsc#1204290).
    - CVE-2022-41222: Fixed a use-after-free via a stale TLB (bsc#1203624).
    - CVE-2022-39189: Fixed mishandled TLB flush operation in certain KVM_VCPU_PREEMPTED situations     (bsc#1203067).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5708-1 advisory.

    Snke Huster discovered that an integer overflow vulnerability existed in the WiFi driver stack in the     Linux kernel, leading to a buffer overflow. A physically proximate attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41674)

    Snke Huster discovered that a use-after-free vulnerability existed in the WiFi driver stack in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-42719)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly perform reference     counting in some situations, leading to a use-after-free vulnerability. A physically proximate attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2022-42720)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly handle BSSID/SSID     lists in some situations. A physically proximate attacker could use this to cause a denial of service     (infinite loop). (CVE-2022-42721)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel contained a NULL pointer     dereference vulnerability in certain situations. A physically proximate attacker could use this to cause a     denial of service (system crash). This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.10.
    (CVE-2022-42722)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3173 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3173-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     November 1, 2022                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.149-2~deb10u1     CVE ID         : CVE-2021-4037 CVE-2022-0171 CVE-2022-1184 CVE-2022-1679                      CVE-2022-2153 CVE-2022-2602 CVE-2022-2663 CVE-2022-2905                      CVE-2022-3028 CVE-2022-3061 CVE-2022-3176 CVE-2022-3303                      CVE-2022-3586 CVE-2022-3621 CVE-2022-3625 CVE-2022-3629                      CVE-2022-3633 CVE-2022-3635 CVE-2022-3646 CVE-2022-3649                      CVE-2022-20421 CVE-2022-20422 CVE-2022-39188 CVE-2022-39190                      CVE-2022-39842 CVE-2022-40307 CVE-2022-41222 CVE-2022-41674                      CVE-2022-42719 CVE-2022-42720 CVE-2022-42721 CVE-2022-42722                      CVE-2022-43750     Debian Bug     : 1017425 1019248

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2021-4037

        Christian Brauner reported that the inode_init_owner function for         the XFS filesystem in the Linux kernel allows local users to         create files with an unintended group ownership allowing attackers         to escalate privileges by making a plain file executable and SGID.

    CVE-2022-0171

        Mingwei Zhang reported that a cache incoherence issue in the SEV         API in the KVM subsystem may result in denial of service.

    CVE-2022-1184

        A flaw was discovered in the ext4 filesystem driver which can lead         to a use-after-free. A local user permitted to mount arbitrary         filesystems could exploit this to cause a denial of service (crash         or memory corruption) or possibly for privilege escalation.

    CVE-2022-1679

        The syzbot tool found a race condition in the ath9k_htc driver         which can lead to a use-after-free.  This might be exploitable to         cause a denial service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2022-2153

        kangel reported a flaw in the KVM implementation for x86         processors which could lead to a null pointer dereference. A local         user permitted to access /dev/kvm could exploit this to cause a         denial of service (crash).

    CVE-2022-2602

        A race between handling an io_uring request and the Unix socket         garbage collector was discovered. An attacker can take advantage         of this flaw for local privilege escalation.

    CVE-2022-2663

        David Leadbeater reported flaws in the nf_conntrack_irc         connection-tracking protocol module. When this module is enabled         on a firewall, an external user on the same IRC network as an         internal user could exploit its lax parsing to open arbitrary TCP         ports in the firewall, to reveal their public IP address, or to         block their IRC connection at the firewall.

    CVE-2022-2905

        Hsin-Wei Hung reported a flaw in the eBPF verifier which can lead         to an out-of-bounds read.  If unprivileged use of eBPF is enabled,         this could leak sensitive information.  This was already disabled         by default, which would fully mitigate the vulnerability.

    CVE-2022-3028

        Abhishek Shah reported a race condition in the AF_KEY subsystem,         which could lead to an out-of-bounds write or read.  A local user         could exploit this to cause a denial of service (crash or memory         corruption), to obtain sensitive information, or possibly for         privilege escalation.

    CVE-2022-3061

        A flaw was discovered in the i740 driver which may result in         denial of service.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-3176

        A use-after-free flaw was discovered in the io_uring subsystem         which may result in local privilege escalation to root.

    CVE-2022-3303

        A race condition in the snd_pcm_oss_sync function in the sound         subsystem in the Linux kernel due to improper locking may result         in denial of service.

    CVE-2022-3586 (ZDI-22-1452)

        The Zero Day Initiative reported a flaw in the sch_sfb network         scheduler, which may lead to a use-after-free and leak of         sensitive information from the kernel.

    CVE-2022-3621, CVE-2022-3646

        The syzbot tool found flaws in the nilfs2 filesystem driver which         can lead to a null pointer dereference or memory leak.  A user         permitted to mount arbitrary filesystem images could use these to         cause a denial of service (crash or resource exhaustion).

    CVE-2022-3625

        A flaw was discovered in the devlink subsystem which can lead to         a use-after-free.  The security impact of this is unclear.

    CVE-2022-3629

        The syzbot tool found a memory leak in the Virtual Socket Protocol         implementation.  A local user could exploit this to cause a denial         of service (resource exhaustion).

    CVE-2022-3633

        The Linux Verification Center found a memory leak in the SAE J1939         protocol implementation.  A local user could exploit this to cause         a denial of service (resource exhaustion).

    CVE-2022-3635

        Several race conditions were discovered in the idt77252 ATM         driver, which can lead to a use-after-free if the module is         removed.  The security impact of this is unclear.

    CVE-2022-3649

        The syzbot tool found flaws in the nilfs2 filesystem driver which         can lead to a use-after-free.  A user permitted to mount arbitrary         filesystem images could use these to cause a denial of service         (crash or memory corruption) or possibly for privilege escalation.

    CVE-2022-20421

        A use-after-free vulnerability was discovered in the         binder_inc_ref_for_node function in the Android binder driver. On         systems where the binder driver is loaded, a local user could         exploit this for privilege escalation.

    CVE-2022-20422

        A race condition was discovered in the instruction emulator for         64-bit Arm systems.  Concurrent changes to the sysctls that         control the emulator could result in a null pointer dereference.
        The security impact of this is unclear.

    CVE-2022-39188

        Jann Horn reported a race condition in the kernel's handling of         unmapping of certain memory ranges. When a driver created a memory         mapping with the VM_PFNMAP flag, which many GPU drivers do, the         memory mapping could be removed and freed before it was flushed         from the CPU TLBs. This could result in a page use-after-free. A         local user with access to such a device could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2022-39190

        Gwangun Jung reported a flaw in the nf_tables subsystem.  A local         user could exploit this to cause a denial of service (crash).

    CVE-2022-39842

        An integer overflow was discovered in the pxa3xx-gcu video driver         which could lead to a heap out-of-bounds write.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-40307

        A race condition was discovered in the EFI capsule-loader driver,         which could lead to use-after-free. A local user permitted to         access this device (/dev/efi_capsule_loader) could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation. However, this device is normally only         accessible by the root user.

    CVE-2022-41222

        A race condition was discovered in the memory management subsystem         that can lead to stale TLB entries.  A local user could exploit         this to cause a denial of service (memory corruption or crash),         information leak, or privilege escalation.

    CVE-2022-41674, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721,     CVE-2022-42722

        Soenke Huster discovered several vulnerabilities in the mac80211         subsystem triggered by WLAN frames which may result in denial of         service or the execution of arbitrary code.

    CVE-2022-43750

        The syzbot tool found that the USB monitor (usbmon) driver allowed         user-space programs to overwrite the driver's data structures.  A         local user permitted to access a USB monitor device could exploit         this to cause a denial of service (memory corruption or crash) or         possibly for privilege escalation.  However, by default only the         root user can access such devices.

    For Debian 10 buster, these problems have been fixed in version     5.10.149-2~deb10u1.  This update also fixes a regression for some     older 32-bit PCs (bug #1017425), and enables the i10nm_edac driver     (bug #1019248).  It additionally includes many more bug fixes from     stable updates 5.10.137-5.10.149 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

    --     Ben Hutchings - Debian developer, member of kernel, installer and LTS teams     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3998-1 advisory.

    The SUSE Linux Enterprise 15-SP4 Azure kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or     potentially escalate their privileges on the system (bsc#1199904).
    - CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to     cause DoS (bnc#1200788).
    - CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686     bsc#1196018).
    - CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege     escalation or DoS (bnc#1202700).
    - CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET     and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
    - CVE-2022-33981: Fixed a use-after-free in floppy driver (bnc#1200692).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c     (bsc#1204171).
    - CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
    - CVE-2022-3526: Fixed a memory leak in macvlan_handle_frame() from drivers/net/macvlan.c (bnc#1204353).
    - CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bnc#1204402).
    - CVE-2022-3545: Fixed use-after-free in area_cache_get() in     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
    - CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local     privilege escalation or DoS (bnc#1204470).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bnc#1204439).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
    - CVE-2022-3619: Fixed memory leak in l2cap_recv_acldata() in net/bluetooth/l2cap_core.c of the component     (bnc#1204569).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bnc#1204574).
    - CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c     (bnc#1204637).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
    - CVE-2022-3633: Fixed memory leak in j1939_session_destroy() in net/can/j1939/transport.c (bnc#1204650).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
    - CVE-2022-40476: Fixed a null pointer dereference in fs/io_uring.c (bnc#1203435).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bnc#1203514).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
    - CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
    - CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)
    - CVE-2022-42721: Avoid nontransmitted BSS list corruption. (bsc#1204060)
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bnc#1204653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5752-1 advisory.

    David Bouman and Billy Jheng Bing Jhong discovered that a race condition existed in the io_uring subsystem     in the Linux kernel, leading to a use- after-free vulnerability. A local attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2602)

    Snke Huster discovered that an integer overflow vulnerability existed in the WiFi driver stack in the     Linux kernel, leading to a buffer overflow. A physically proximate attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41674)

    Snke Huster discovered that a use-after-free vulnerability existed in the WiFi driver stack in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-42719)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly perform reference     counting in some situations, leading to a use-after-free vulnerability. A physically proximate attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2022-42720)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly handle BSSID/SSID     lists in some situations. A physically proximate attacker could use this to cause a denial of service     (infinite loop). (CVE-2022-42721)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel contained a NULL pointer     dereference vulnerability in certain situations. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2022-42722)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information.(CVE-2022-41858)

    There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req     function which can be used to leak kernel pointers remotely. We recommend upgrading past commit     https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e(CVE-2022-42895)

    There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4(CVE-2022-42896)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects     the function vsock_connect of the file net/vmw_vsock/af_vsock.c of the component IPsec. The manipulation     leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier     assigned to this vulnerability.(CVE-2022-3629)

    A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges.(CVE-2022-3628)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability.(CVE-2022-3625)

    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability.(CVE-2022-3567)

    drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory.(CVE-2022-43750)

    A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087.(CVE-2022-3564)

    A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability.(CVE-2022-3545)

    A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability.(CVE-2022-3566)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The     manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to     apply a patch to fix this issue. The associated identifier of this vulnerability is     VDB-211363.(CVE-2022-3594)

    A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue     is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     of this vulnerability is VDB-211088.(CVE-2022-3565)

    A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the     function bnx2x_tpa_stop of the file drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c of the component BPF.
    The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211042 is     the identifier assigned to this vulnerability.(CVE-2022-3542)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability.(CVE-2022-3524)

    A flaw was found in the Linux kernels networking code. A use-after-free was found in the way the     sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and     freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a     denial of service.(CVE-2022-3586)

    An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.(CVE-2022-41674)

    mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double     reuse.(CVE-2022-42703)

    roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a report-     value is in progress.(CVE-2022-41850)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information.(CVE-2022-41858)

    There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req     function which can be used to leak kernel pointers remotely. We recommend upgrading past commit     https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e(CVE-2022-42895)

    There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4(CVE-2022-42896)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects     the function vsock_connect of the file net/vmw_vsock/af_vsock.c of the component IPsec. The manipulation     leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier     assigned to this vulnerability.(CVE-2022-3629)

    A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges.(CVE-2022-3628)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability.(CVE-2022-3625)

    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability.(CVE-2022-3567)

    drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory.(CVE-2022-43750)

    A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087.(CVE-2022-3564)

    A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability.(CVE-2022-3545)

    A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability.(CVE-2022-3566)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The     manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to     apply a patch to fix this issue. The associated identifier of this vulnerability is     VDB-211363.(CVE-2022-3594)

    A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue     is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     of this vulnerability is VDB-211088.(CVE-2022-3565)

    A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the     function bnx2x_tpa_stop of the file drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c of the component BPF.
    The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211042 is     the identifier assigned to this vulnerability.(CVE-2022-3542)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability.(CVE-2022-3524)

    A flaw was found in the Linux kernels networking code. A use-after-free was found in the way the     sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and     freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a     denial of service.(CVE-2022-3586)

    An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.(CVE-2022-41674)

    mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double     reuse.(CVE-2022-42703)

    roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a report-     value is in progress.(CVE-2022-41850)

    In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with 'tc qdisc' and 'tc class' commands. This affects qdisc_graft in     net/sched/sch_api.c.(CVE-2022-47929)

    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash.(CVE-2023-0394)

    cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results).(CVE-2023-23454)

    atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results).(CVE-2023-23455)

    A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches     usb device. A local user could use this flaw to crash the system.(CVE-2022-4662)

    An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in     drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup().(CVE-2022-3108)

    An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in     drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array().(CVE-2022-3105)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernels filesystem     sub-component. This flaw allows a local attacker with a user privilege to cause a denial of     service.(CVE-2022-1184)

    In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could     lead to local escalation of privilege with no additional execution privileges needed. User interaction is     not needed for exploitation.(CVE-2022-20566)

    An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This     issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the     resources, causing denial of service or potentially crashing the system.(CVE-2022-3903)

    A use-after-free flaw was found in the Linux kernels SGI GRU driver in the way the first     gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the     gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate     their privileges on the system.(CVE-2022-3424)

    In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.(CVE-2022-41218)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2951 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were     built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of     bytes located in supposedly non-executable regions of a file. (CVE-2022-25265)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087. (CVE-2022-3564)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the     identifier assigned to this vulnerability. (CVE-2022-3619)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges. (CVE-2022-3628)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux     kernel. The issue occurs when it forgets to set the free pointer server->hostname to NULL, leading to an     invalid pointer request. (CVE-2023-1195)

  - A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.
    This issue may allow a local attacker with user privilege to cause a denial of service. (CVE-2023-1582)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167218	SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2022:3897-1)	Nessus	SuSE Local Security Checks	2022/11/9	2026/6/25	high
176317	Oracle Linux 8 : kernel (ELSA-2023-2951)	Nessus	Oracle Linux Local Security Checks	2023/5/24	2024/1/16	high
166272	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5693-1)	Nessus	Ubuntu Local Security Checks	2022/10/19	2024/8/28	high
239045	TencentOS Server 3: kernel (TSSA-2023:0153)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	high
175726	Oracle Linux 9 : kernel (ELSA-2023-2458)	Nessus	Oracle Linux Local Security Checks	2023/5/15	2024/1/16	high
166187	SUSE SLES15 Security Update : kernel (Live Patch 2 for SLE 15 SP4) (SUSE-SU-2022:3605-1)	Nessus	SuSE Local Security Checks	2022/10/18	2026/6/25	high
166232	Debian DSA-5257-1 : linux - security update	Nessus	Debian Local Security Checks	2022/10/19	2025/1/24	high
166247	SUSE SLES15: kernel-livepatch-5_3_18-150200_24_112-default / etc (SUSE-SU-2022:3648-1)	Nessus	SuSE Local Security Checks	2022/10/19	2026/6/25	high
166799	Ubuntu 20.04 LTS / 22.04 LTS : backport-iwlwifi-dkms vulnerabilities (USN-5708-1)	Nessus	Ubuntu Local Security Checks	2022/11/2	2025/9/3	high
166822	Debian dla-3173 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	2022/11/2	2025/1/22	high
167728	SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2022:3998-1)	Nessus	SuSE Local Security Checks	2022/11/16	2026/6/25	high
168317	Ubuntu 22.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-5752-1)	Nessus	Ubuntu Local Security Checks	2022/12/1	2024/8/27	high
169624	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-1126)	Nessus	Huawei Local Security Checks	2023/1/6	2025/9/30	high
174851	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2023-1671)	Nessus	Huawei Local Security Checks	2023/4/27	2025/9/26	high
176166	AlmaLinux 8 : kernel (ALSA-2023:2951)	Nessus	Alma Linux Local Security Checks	2023/5/20	2024/1/16	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high