According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A deadlock flaw was found in the Linux kernel's BPF subsystem. This flaw allows a local user to     potentially crash the system. (CVE-2023-0160)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

  - A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem. (CVE-2023-1838)

  - A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege. (CVE-2023-2176)

  - An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

  - An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS). (CVE-2022-36280)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This     issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the     resources, causing denial of service or potentially crashing the system. (CVE-2022-3903)

  - A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking     configuration (redirecting egress packets to ingress using TC action 'mirred') a local unprivileged user     could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a     retransmission, resulting in a denial of service condition. (CVE-2022-4269)

  - The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit     a664ec9158eeddd75121d39c9a0758016097fa96 (CVE-2023-0045)

  - A deadlock flaw was found in the Linux kernel's BPF subsystem. This flaw allows a local user to     potentially crash the system. (CVE-2023-0160)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ('net: sched: fix race     condition in qdisc_graft()') not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a     user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2023-1073)

  - A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may     occur when a user starts a malicious networking service and someone connects to this service. This could     allow a local user to starve resources, causing a denial of service. (CVE-2023-1074)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

  - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - A remote denial of service vulnerability was found in the Linux kernel's TIPC kernel module. The while     loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue.
    Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system     to instantly spike to 100%, causing a denial of service condition. (CVE-2023-1390)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.
    This issue may allow a local attacker with user privilege to cause a denial of service. (CVE-2023-1582)

  - A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

  - A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem. (CVE-2023-1838)

  - In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure     (for registering the sysctl table under a new location) during the renaming of a device. (CVE-2023-26545)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

  - do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

  - An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer     overflow. (CVE-2023-28772)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6090-1 advisory.

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the Android Binder IPC subsystem in the Linux kernel did not properly validate     inputs in some situations, leading to a use- after-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-20938)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6133-1 advisory.

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel did not     properly perform filter deactivation in some situations. A local attacker could possibly use this to gain     elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier     has been removed. (CVE-2023-1829)

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-1872)

    It was discovered that the Android Binder IPC subsystem in the Linux kernel did not properly validate     inputs in some situations, leading to a use- after-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-20938)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6095-1 advisory.

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1800-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
    - CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
    - CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in     infiniband RDMA (bsc#1209778).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel     which could lead to system crash (bsc#1207168).
    - CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
    - CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
    - CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
    - CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
    - CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
    - CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
    - CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
    - CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c     (bsc#1209291).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/bluetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in     do_tls_getsockopt in net/tls/tls_main.c (bsc#1209366).
    - CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1897-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a     local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).
    - CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause     system crashes (bsc#1207168).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
    - CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/bluetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28466: Fixed race condition that could lead to use-after-free or NULL pointer dereference in     do_tls_getsockopt in net/tls/tls_main.c (bsc#1209366).
    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779).
    - CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul     in fs/nfsd/nfs4proc.c (bsc#1209788).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2023-1281: Fixed use after free that could lead to privilege escalation in tcindex (bsc#1209634).
    - CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
    - CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
    - CVE-2023-23001: Fixed misinterpretation of regulator_get return value in drivers/scsi/ufs/ufs-mediatek.c     (bsc#1208829).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2232-1 advisory.

    The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-2483: Fixed a use after free bug in emac_remove due caused by a race condition (bsc#1211037).
    - CVE-2023-2124: Fixed an out of bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could     use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
    - CVE-2017-5753: Fixed spectre V1 vulnerability on netlink (bsc#1209547).
    - CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
    - CVE-2020-36691: Fixed a denial of service (unbounded recursion) vulnerability via a nested Netlink     policy with a back reference (bsc#1209613 bsc#1209777).
    - CVE-2023-0394: Fixed a null pointer dereference flaw in the network subcomponent in the Linux kernel     which could lead to system crash (bsc#1207168).
    - CVE-2021-3923: Fixed stack information leak vulnerability that could lead to kernel protection bypass in     infiniband RDMA (bsc#1209778).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bsc#1194535).
    - CVE-2022-20567: Fixed use after free that could lead to a local privilege escalation in pppol2tp_create     of l2tp_ppp.c (bsc#1208850).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1855: Fixed an use-after-free flaw in xgene_hwmon_remove (bsc#1210202).
    - CVE-2023-1989: Fixed an use-after-free flaw in btsdio_remove (bsc#1210336).
    - CVE-2023-1990: Fixed an use-after-free flaw in ndlc_remove (bsc#1210337).
    - CVE-2023-1998: Fixed an use-after-free flaw during login when accessing the shost ipaddress     (bsc#1210506).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
    - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type     confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid     classification results) (bsc#1207125).
    - CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c     (bsc#1209291).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/uetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
    - CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove     (bsc#1210329).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3138 advisory.

    - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743     CVE-2024-25742}
    - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876]     {CVE-2023-52489}
    - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489}
    - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614]     {CVE-2024-0841}
    - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430]     {CVE-2024-26602}
    - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565}
    - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448}
    - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241]     {CVE-2023-52434}
    - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434}
    - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Carlos Maiolino) [RHEL-23386] {CVE-2021-33631}
    - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-23506]     {CVE-2024-1086}
    - Bluetooth: Add more enc key size check (David Marlin) [RHEL-19666] {CVE-2023-24023}
    - Bluetooth: Normalize HCI_OP_READ_ENC_KEY_SIZE cmdcmplt (David Marlin) [RHEL-19666] {CVE-2023-24023}
    - drm/amdgpu: Fix potential fence use-after-free v2 (Michel Danzer) [RHEL-22504] {CVE-2023-51042}
    - serial: core: return early on unsupported ioctls (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix race condition in status line change on dead connections (Wander Lairson Costa)     [RHEL-19955] {CVE-2023-6546}
    - Revert 'tty: n_gsm: fix UAF in gsm_cleanup_mux' (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix UAF in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: add parameter negotiation support (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: add parameters used with parameter negotiation (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: introduce macro for minimal unit size (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: name the debug bits (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: introduce gsm_control_command() function (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: replace use of gsm_read_ea() with gsm_read_ea_val() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: name gsm tty device minors (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: initialize more members at gsm_alloc_mux() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix flow control handling in tx path (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix resource allocation order in gsm_activate_mux() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix deadlock and link starvation in outgoing data path (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix race condition in gsmld_write() (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix non flow control frames during mux flow off (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix missing timer to handle stalled links (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix tty registration before control channel open (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix user open not possible at responder until initiator open (Wander Lairson Costa)     [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Debug output allocation must use GFP_ATOMIC (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Fix packet data hex dump output (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix buffer over-read in gsm_dlci_data() (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() (Wander Lairson Costa)     [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix software flow control handling (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix invalid use of MSC in advanced option (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix broken virtual tty handling (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix missing update of modem controls after DLCI open (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix reset fifo race condition (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix missing tty wakeup in convergence layer type 2 (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong signal octets encoding in MSC (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix wrong command frame length field encoding (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong command retry handling (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix missing explicit ldisc flush (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix wrong DLCI release order (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix insufficient txframe size (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix frame reception handling (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 (Wander Lairson Costa)     [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix mux cleanup after unregister tty device (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix decoupled mux resource (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix restart handling via CLD command (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix deadlock in gsmtty_open() (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix wrong modem processing in convergence layer type 2 (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix wrong tty control line for flow control (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix NULL pointer access due to DLCI release (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: fix encoding of command/response bit (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: fix SW flow control encoding/handling (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove tty parameter from mxser_receive_chars_new() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - mxser: don't throttle manually (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: make mxser_port::ldisc_stop_rx a bool (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Don't ignore write return value in gsmld_output() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: clean up indenting in gsm_queue() (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Save dlci address open status when config requester (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Modify gsmtty driver register method when config requester (Wander Lairson Costa)     [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Delete gsmtty open SABM frame when config requester (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Modify CR,PF bit printk info when config requester (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Modify CR,PF bit when config requester (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: stop using alloc_tty_driver (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: don't store semi-state into tty drivers (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - hvsi: don't panic on tty_register_driver failure (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - amiserial: switch rs_table to a single state (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - amiserial: expand 'custom' (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - amiserial: use memset to zero serial_state (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - amiserial: remove serial_* strings (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: drop mxser_port::custom_divisor (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: drop mxser_port::baud_base (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove unused mxser_port::stop_rx (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: don't allocate MXSER_PORTS + 1 (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove cnt from mxser_receive_chars (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove MOXA_GETMSTATUS ioctl (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove MOXA_GETDATACOUNT ioctl (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove MOXA_CHKPORTENABLE ioctl (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove MOXA_ASPP_LSTATUS ioctl (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove MOXA_ASPP_MON and friends (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove MOXA_SET_BAUD_METHOD ioctl (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove MOXA_GET_MAJOR deprecated ioctl (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: drop unused MOXA_DIAGNOSE macro (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: drop UART_MCR_AFE and UART_LSR_SPECIAL defines (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - mxser: remove else from LSR bits checks (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: extract mxser_receive_chars_old (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: extract mxser_receive_chars_new (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: simplify mxser_interrupt and drop mxser_board::vector_mask (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - mxser: extract port ISR (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: cleanup LSR handling in mxser_receive_chars (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: remove nonsense from ISR (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: drop constant board::uart_type (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: introduce enum mxser_must_hwid (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: rename mxser_board::chip_flag to must_hwid (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: rename CheckIsMoxaMust to mxser_get_must_hwid (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: cleanup Gpci_uart_info struct (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: integrate mxser.h into .c (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - mxser: drop ISA support (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: use goto-failpaths in gsm_init (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: mxser: drop low-latency workaround (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: check error while registering tty devices (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: mxser: fix TIOCSSERIAL jiffies conversions (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm, remove duplicates of parameters (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: do not check tty_unregister_driver's return value (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: nozomi, remove init/exit messages (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty_port: drop last traces of low_latency (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Demote obvious abuse of kernel-doc and supply other missing docss (Wander Lairson Costa)     [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm, eliminate indirection for gsm->{output,error}() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Fix bogus i++ in gsm_data_kick (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Remove unnecessary test in gsm_print_packet() (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Fix waking up upper tty layer when room available (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Fix SOF skipping (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Improve debug output (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: switch constipated to bool (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: switch throttled to bool (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: switch dead to bool (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: introduce enum gsm_dlci_mode (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: introduce enum gsm_dlci_state (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: drop unneeded gsm_dlci->fifo field (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Replace zero-length array with flexible-array member (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: avoid recursive locking with async port hangup (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: add helpers to convert mux-num to/from tty-base (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - docs: serial: move it to the driver-api (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - docs: serial: convert docs to ReST and rename to *.rst (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - tty: n_gsm: Mark expected switch fall-throughs (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - n_gsm: Constify u8 and unsigned char usage (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty: n_gsm: Add copy_config() and gsm_config() to prepare for serdev (Wander Lairson Costa) [RHEL-19955]     {CVE-2023-6546}
    - mxser: switch to ->[sg]et_serial() (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - amiserial: switch to ->[sg]et_serial() (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - tty/serial_core: add ISO7816 infrastructure (Wander Lairson Costa) [RHEL-19955] {CVE-2023-6546}
    - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts (Jocelyn Falempe) [RHEL-3179]     {CVE-2022-38096}
    - atm: Fix Use-After-Free in do_vcc_ioctl (Guillaume Nault) [RHEL-21179] {CVE-2023-51780}
    - Bluetooth: Fix double free in hci_conn_cleanup (David Marlin) [RHEL-2555] {CVE-2023-28464}
    - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Waiman Long) [RHEL-20926] {CVE-2023-45863}
    - kobject: modify kobject_get_path() to take a const * (Waiman Long) [RHEL-20926] {CVE-2023-45863}
    - kobject: Remove docstring reference to kset (Waiman Long) [RHEL-20926] {CVE-2023-45863}
    - nvmet-tcp: Fix the H2C expected PDU len calculation (Maurizio Lombardi) [RHEL-19155 RHEL-19161     RHEL-19167] {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - nvmet-tcp: remove boilerplate code (Maurizio Lombardi) [RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6536     CVE-2023-6535 CVE-2023-6356}
    - nvmet-tcp: fix a crash in nvmet_req_complete() (Maurizio Lombardi) [RHEL-19155 RHEL-19161 RHEL-19167]     {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length (Maurizio Lombardi) [RHEL-19155     RHEL-19161 RHEL-19167] {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - ipv6: Remove extra counter pull before gc (Davide Caratti) [RHEL-21457] {CVE-2023-52340}
    - ipv6: remove max_size check inline with ipv4 (Davide Caratti) [RHEL-21457] {CVE-2023-52340}
    - net/dst: use a smaller percpu_counter batch for dst entries accounting (Davide Caratti) [RHEL-21457]     {CVE-2023-52340}
    - net: add a route cache full diagnostic message (Davide Caratti) [RHEL-21457] {CVE-2023-52340}
    - xfs: kill the XFS_IOC_{ALLOC,FREE}SP* ioctls (Andrey Albershteyn) [RHEL-8464] {CVE-2021-4155}
    - ida: Fix crash in ida_free when the bitmap is empty (Wander Lairson Costa) [RHEL-19681] {CVE-2023-6915}
    - net: tls, update curr on splice as well (Sabrina Dubroca) [RHEL-19065] {CVE-2024-0646}
    - smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-18990] {CVE-2023-6606}
    - smb: client: fix potential OOB in smb2_dump_detail() (Scott Mayhew) [RHEL-19144] {CVE-2023-6610}
    - smb: client: fix potential OOB in cifs_dump_detail() (Scott Mayhew) [RHEL-19144] {CVE-2023-6610}
    - mISDN: fix use-after-free bugs in l1oip timer handlers (Ricardo Robaina) [RHEL-2553 RHEL-2690]     {CVE-2022-3565}
    - netfilter: nf_tables: bail out on mismatching dynset and set expressions (Florian Westphal) [RHEL-19014]     {CVE-2023-6622}
    - netfilter: nft_set_pipapo: skip inactive elements during set walk (Florian Westphal) [RHEL-19721]     {CVE-2023-6817}
    - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Hangbin Liu) [RHEL-19794]     {CVE-2023-6932}
    - perf: Fix perf_event_validate_size() (Michael Petlan) [RHEL-17968] {CVE-2023-6931}
    - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg (Ricardo Robaina) [RHEL-20743]     {CVE-2023-51779}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2805-1 advisory.

    The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2017-5753: Fixed spectre vulnerability in prlimit (bsc#1209256).
    - CVE-2022-3566: Fixed race condition in the TCP Handler (bsc#1204405).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption     (bsc#1208600).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash     the system (bsc#1209039).
    - CVE-2023-1380: Fixed a slab-out-of-bound read problem in brcmf_get_assoc_ies() (bsc#1209287).
    - CVE-2023-1390: Fixed remote DoS vulnerability in tipc_link_xmit() (bsc#1209289).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could     use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
    - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
    - CVE-2023-1990: Fixed a use after free in ndlc_remove (bsc#1210337).
    - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
    - CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-2194: Fixed an out-of-bounds write vulnerability in the SLIMpro I2C device driver     (bsc#1210715).
    - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
    - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type     confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid     classification results) (bsc#1207125).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-28328: Fixed a denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c     (bsc#1209291).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/uetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28772: Fixed buffer overflow in seq_buf_putmem_hex in lib/seq_buf.c (bsc#1209549).
    - CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove     (bsc#1210329).
    - CVE-2023-3090: Fixed a heap out-of-bounds write in the ipvlan network driver (bsc#1212842).
    - CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed     local attackers to crash the system at device disconnect (bsc#1212129).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-3159: Fixed use-after-free issue in driver/firewire in outbound_phy_packet_callback     (bsc#1212128).
    - CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
    - CVE-2023-32269: Fixed a use-after-free in af_netrom.c, related to the fact that accept() was also     allowed for a successfully connected AF_NETROM socket (bsc#1211186).
    - CVE-2023-35824: Fixed a use-after-free in dm1105_remove in drivers/media/pci/dm1105/dm1105.c     (bsc#1212501).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based     device.(CVE-2023-33203)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors.(CVE-2023-2513)

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a     reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.(CVE-2023-2483)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    An out-of-bounds memory access flaw was found in the Linux kernels traffic control (QoS) subsystem in     how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used     as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the     system.(CVE-2023-2248)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond     commit74e19ef0ff8061ef55957c3abd71614ef0f42f47(CVE-2023-0459)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

    A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege.(CVE-2023-2176)

    An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace 'data-block[0]' variable was not capped to a number between 0-255 and was used as the size of     a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution.(CVE-2023-2194)

    The Linux kernel allows userspace processes to enable mitigations by calling prctl with     PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed     that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to     attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be     observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened     because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that     STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
    However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons,     which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target     injection against which STIBP protects.(CVE-2023-1998)

    A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault     handler. The issue results from the lack of proper validation of user-supplied data, which can result in a     memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges     and execute arbitrary code in the context of the kernel.(CVE-2023-2008)

    A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation. The io_file_get_fixed function lacks the presence of ctx-uring_lock which can     lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We     recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.(CVE-2023-1872)

    A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue.(CVE-2022-1015)

    An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS).(CVE-2022-36280)

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4.(CVE-2023-30456)

    A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem.(CVE-2023-1838)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks.(CVE-2023-1637)

    A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak.(CVE-2023-1513)

    A double-free flaw was found in the Linux kernels TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system.(CVE-2022-4744)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation.The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.A local attacker user can use     this vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.(CVE-2023-1281)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference).(CVE-2023-28466)

    A use-after-free flaw was found in the Linux kernels core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 ('coredump: Use the vma snapshot in fill_files_note') not     applied yet, then kernel could be affected.(CVE-2023-1249)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
178067	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2315)	Nessus	Huawei Local Security Checks	2023/7/9	2024/1/16	high
178976	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2023-2488)	Nessus	Huawei Local Security Checks	2023/7/28	2023/7/28	high
176090	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6090-1)	Nessus	Ubuntu Local Security Checks	2023/5/18	2025/8/14	high
176617	Ubuntu 22.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6133-1)	Nessus	Ubuntu Local Security Checks	2023/6/2	2025/8/14	high
176227	Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel vulnerabilities (USN-6095-1)	Nessus	Ubuntu Local Security Checks	2023/5/23	2024/8/27	high
174049	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:1800-1)	Nessus	SuSE Local Security Checks	2023/4/11	2026/6/25	high
174533	SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / dlm-kmp-64kb / etc (SUSE-SU-2023:1897-1)	Nessus	SuSE Local Security Checks	2023/4/20	2026/6/25	high
176058	SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / drbd / drbd-kmp-default / etc (SUSE-SU-2023:2232-1)	Nessus	SuSE Local Security Checks	2023/5/18	2026/6/25	high
198038	Oracle Linux 8 : kernel (ELSA-2024-3138)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2026/2/9	critical
178180	SUSE SLES12: kernel-default / kernel-default-base / kernel-default-devel / etc (SUSE-SU-2023:2805-1)	Nessus	SuSE Local Security Checks	2023/7/12	2026/6/26	critical
188944	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2023-2755)	Nessus	Huawei Local Security Checks	2024/1/16	2025/9/29	high

检测

插件搜索

high

high

high

high

high

high

high

high

critical

critical

high