The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2024_4928 advisory.

    * kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned     (CVE-2023-52458)

    * kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773)

    * kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)

    * kernel: dm: call the resume method on internal suspend (CVE-2024-26880)

    * kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852)

    * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

    * kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046)

    * kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030)

    * kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857)

    * kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907)

    * kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885)

    * kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

    * kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459)

    * kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924)

    * kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952)

    * kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)

    * kernel: epoll: be better about file lifetimes (CVE-2024-38580)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4928 advisory.

    - mlxbf_gige: call request_irq() after NAPI initialized (Kamal Heib) [RHEL-43012 RHEL-37179]     {CVE-2024-35907}
    - mlxbf_gige: stop PHY during open() error paths (Kamal Heib) [RHEL-43012 RHEL-37179] {CVE-2024-35907}
    - mlxbf_gige: stop interface during shutdown (Kamal Heib) [RHEL-41708 RHEL-37244] {CVE-2024-35885}
    - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43796 RHEL-43794] {CVE-2022-48743}
    - nfp: flower: handle acti_netdevs allocation failure (Ken Cox) [RHEL-42852 RHEL-35158] {CVE-2024-27046}
    - block: add check that partition length needs to be aligned with block size (Ming Lei) [RHEL-45501     RHEL-26616] {CVE-2023-52458}
    - icmp: prevent possible NULL dereferences from icmp_build_probe() (Antoine Tenart) [RHEL-42974     RHEL-37002] {CVE-2024-35857}
    - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-42689 RHEL-33271]     {CVE-2024-26852}
    - epoll: be better about file lifetimes (Pavel Reichl) [RHEL-44091 RHEL-44083] {CVE-2024-38580}
    - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Dick Kennedy) [RHEL-40659 RHEL-40665     RHEL-24508 RHEL-39793] {CVE-2024-36924}
    - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Dick Kennedy) [RHEL-40659     RHEL-40669 RHEL-24508 RHEL-39887] {CVE-2024-36952}
    - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (Viktor Malik) [RHEL-42640     RHEL-31726] {CVE-2024-26737}
    - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (Ken Cox) [RHEL-41489 RHEL-38415]     {CVE-2021-47459}
    - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41838 RHEL-33217]     {CVE-2024-26880}
    - octeontx2-af: Use separate handlers for interrupts (Kamal Heib) [RHEL-42846 RHEL-35170] {CVE-2024-27030}
    - Squashfs: check the inode number is not the invalid value of zero (Abhi Das) [RHEL-42811 RHEL-35098]     {CVE-2024-26982}
    - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl)     [RHEL-42655 RHEL-31690] {CVE-2024-26773}
    - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-42528     RHEL-38200] {CVE-2023-52809}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5066 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned     (CVE-2023-52458)

    * kernel: ext4: regenerate buddy after block freeing failed if under fc replay (CVE-2024-26601)

    * kernel: PM / devfreq: Synchronize devfreq_monitor_[start/stop] (CVE-2023-52635)

    * kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)

    * kernel: bnxt: prevent skb UAF after handing over to PTP worker (CVE-2022-48637)

    * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947)

    * kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930)

    * kernel: nouveau: lock the client object tree. (CVE-2024-27062)

    * kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030)

    * kernel: vt: fix unicode buffer corruption when deleting characters (CVE-2024-35823)

    * kernel: netfilter: validate user input for expected length (CVE-2024-35896)

    * kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885)

    * kernel: netfilter: complete validation of user input (CVE-2024-35962)

    * kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

    * kernel: i40e: fix vf may be used uninitialized in this function warning (CVE-2024-36020)

    * kernel: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (CVE-2024-36017)

    * kernel: net: core: reject skb_copy(_expand) for fraglist GSO skbs (CVE-2024-36929)

    * kernel: drm/vmwgfx: Fix invalid reads in fence signaled events (CVE-2024-36960)

    * kernel: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (CVE-2024-33621)

    * kernel: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (CVE-2024-38384)

    * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663)

    * kernel: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (CVE-2023-52885)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
355105	Rocky Linux 9 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-64k / kernel-64k-core / etc Multiple Vulnerabilities (crlsa-2024_4928)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
204945	Oracle Linux 9 : kernel (ELSA-2024-4928)	Nessus	Oracle Linux Local Security Checks	2024/8/1	2026/2/9	high
205152	RHEL 9 : kernel (RHSA-2024:5066)	Nessus	Red Hat Local Security Checks	2024/8/7	2024/11/7	high

检测

插件搜索

high

high

high