The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0825 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

    Security Fix(es):

    * kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)

    * kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

    * kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container     breakout (CVE-2021-4154)

    * kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

    * kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

    * kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

    * kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

    * kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Intel QAT Kernel power up fix (BZ#2016437)

    * RHEL8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

    * [Lenovo 8.4 bug] audio_HDMI certification failed on RHEL 8.4GA (No hdmi out) (BZ#2027335)

    * [RHEL-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online     migration (BZ#2027448)

    * iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

    * [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install RHEL8.4(beta or rc1) in the     legacy BIOS mode. (BZ#2034949)

    * Double free of kmalloc-64  cache   struct ib_port->pkey_group from module ib_core  . (BZ#2038724)

    * Bus error with huge pages enabled (BZ#2039015)

    * RHEL8 - kvm: floating interrupts may get stuck (BZ#2040769)

    * Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

    * Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

    * Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

    * DNS lookup failures when run two times in a row (BZ#2043548)

    * net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

    * Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

    * OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

    * Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

    * ice: bug fix series for 8.6 (BZ#2051951)

    * panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

    * ceph omnibus backport for RHEL-8.6.0 (BZ#2053725)

    * SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

    * Selinux  is not  allowing SCTP connection setup between inter pod communication in enforcing mode     (BZ#2054117)

    * dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9245 advisory.

    - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann)  [Orabug: 33942325]     {CVE-2022-0847}
    - arm64: Use the clearbhb instruction in mitigations (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)  [Orabug: 33937423] {CVE-2022-23960}
    - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: Mitigate spectre style branch history side channels (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: Add part number for Arm Cortex-A77 (Rob Herring)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: Add percpu vectors for EL1 (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: entry: Move the trampoline data page before the text page (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Make the trampoline cleanup optional (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: entry.S: Add ventry overflow sanity checks (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.'     (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)     [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)     [Orabug: 33937344]  {CVE-2021-26401}
    - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug:
    33937344]  {CVE-2021-26401}
    - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Fix bug in retpoline mode on AMD with  (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso)  [Orabug:
    33900416]  {CVE-2022-25636}
    - KVM: x86: nSVM: don't copy virt_ext from vmcb12 (Maxim Levitsky)  [Orabug: 33805849]  {CVE-2021-3653}     {CVE-2021-3656}
    - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin)  [Orabug: 33835810]     {CVE-2022-0330}
    - tipc: improve size validations for received domain records (Jon Maloy)  [Orabug: 33850801]     {CVE-2022-0435} {CVE-2022-0435}
    - USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman)  [Orabug: 33739525]     {CVE-2021-39685}
    - USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman)  [Orabug: 33739525]  {CVE-2021-39685}
    - USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman)  [Orabug: 33739525]     {CVE-2021-39685}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9244 advisory.

    - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann)  [Orabug: 33942325]     {CVE-2022-0847}
    - arm64: Use the clearbhb instruction in mitigations (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)  [Orabug: 33937423] {CVE-2022-23960}
    - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: Mitigate spectre style branch history side channels (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: Add part number for Arm Cortex-A77 (Rob Herring)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: Add percpu vectors for EL1 (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: entry: Move the trampoline data page before the text page (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Make the trampoline cleanup optional (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: entry.S: Add ventry overflow sanity checks (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.'     (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)     [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)     [Orabug: 33937344]  {CVE-2021-26401}
    - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug:
    33937344]  {CVE-2021-26401}
    - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Fix bug in retpoline mode on AMD with  (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso)  [Orabug:
    33900416]  {CVE-2022-25636}
    - KVM: x86: nSVM: don't copy virt_ext from vmcb12 (Maxim Levitsky)  [Orabug: 33805849]  {CVE-2021-3653}     {CVE-2021-3656}
    - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin)  [Orabug: 33835810]     {CVE-2022-0330}
    - tipc: improve size validations for received domain records (Jon Maloy)  [Orabug: 33850801]     {CVE-2022-0435} {CVE-2022-0435}
    - USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman)  [Orabug: 33739525]     {CVE-2021-39685}
    - USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman)  [Orabug: 33739525]  {CVE-2021-39685}
    - USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman)  [Orabug: 33739525]     {CVE-2021-39685}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5362-1 advisory.

    Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local     attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636)

    Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that     hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local     attacker could potentially use this to expose sensitive information. (CVE-2022-23960)

    It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in     certain situations. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-23222)

    Max Kellermann discovered that the Linux kernel incorrectly handled Unix pipes. A local attacker could     potentially use this to modify any file that could be opened for reading. (CVE-2022-0847)

    Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly     restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain     administrative privileges. (CVE-2022-0492)

    William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux     kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker     could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-0185)

    Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that     hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local     attacker could potentially use this to expose sensitive information. (CVE-2022-0001)

    Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that     could result in a read-after-free. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2021-4083)

    It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2021-4090)

    Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size     correctly when pre-allocating space in some situations. A local attacker could use this to expose     sensitive information. (CVE-2021-4155)

    It was discovered that the AMD Radeon GPU driver in the Linux kernel did not properly validate writes in     the debugfs file system. A privileged attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2021-42327)

    Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform     a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or     possibly execute arbitrary code. (CVE-2022-0330)

    Samuel Page discovered that the Transparent Inter-Process Communication (TIPC) protocol implementation in     the Linux kernel contained a stack-based buffer overflow. A remote attacker could use this to cause a     denial of service (system crash) for systems that have a TIPC bearer configured. (CVE-2022-0435)

    It was discovered that the KVM implementation for s390 systems in the Linux kernel did not properly     prevent memory operations on PVM guests that were in non-protected mode. A local attacker could use this     to obtain unauthorized memory write access. (CVE-2022-0516)

    It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in     certain situations. A remote attacker could possibly use this to cause a denial of service (memory     exhaustion). (CVE-2022-0742)

    It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain     failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this     to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9313 advisory.

    - netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso)  [Orabug: 34012925]     {CVE-2022-1016}
    - btrfs: unlock newly allocated extent buffer after error (Qu Wenruo)  [Orabug: 33997138]  {CVE-2021-4149}
    - sr9700: sanity check for packet length (Oliver Neukum)  [Orabug: 33962706]  {CVE-2022-26966}
    - lib/timerqueue: Rely on rbtree semantics for next timer (Davidlohr Bueso)  [Orabug: 33406086]     {CVE-2021-20317} {CVE-2021-20317}
    - NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust)  [Orabug: 33958155]     {CVE-2022-24448}
    - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)     [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)     [Orabug: 33937656]  {CVE-2021-26401}
    - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug:
    33937656]  {CVE-2021-26401}
    - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Fix bug in retpoline mode on AMD with 'spectre_v2=none' (Patrick Colp)  [Orabug:
    33937656]  {CVE-2021-26401}
    - ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet)  [Orabug: 33917057]  {CVE-2020-36516}
    - ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet)  [Orabug: 33917057]     {CVE-2020-36516}
    - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann)  [Orabug: 33910800]     {CVE-2022-0847}
    - udf: Restore i_lenAlloc when inode expansion fails (Jan Kara)  [Orabug: 33870267]  {CVE-2022-0617}
    - udf: Fix NULL ptr deref when converting from inline format (Jan Kara)  [Orabug: 33870267]     {CVE-2022-0617}
    - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause)  [Orabug: 33840433]     {CVE-2022-22942}
    - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin)  [Orabug: 33835811]     {CVE-2022-0330}
    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit)  [Orabug: 33617219]  {CVE-2021-4002}
    - tipc: improve size validations for received domain records (Jon Maloy)  [Orabug: 33850803]     {CVE-2022-0435} {CVE-2022-0435}
    - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman)  [Orabug: 33825688]     {CVE-2022-0492}
    - Linux 4.14.257 (Greg Kroah-Hartman)   {CVE-2021-38199}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0825 advisory.

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's     cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting     the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.
    (CVE-2021-4154)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for     s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain     unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
    (CVE-2022-0516)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

  - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2362-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
    - CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
    - CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
    - CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
    - CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
    - CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
    - CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
    - CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled     (bsc#1202623).
    - CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
    - CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
    - CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
    - CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
    - CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
    - CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
    - CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
    - CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
    - CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
    - CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
    - CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:0429-1 advisory.

    This update for the Linux Kernel 5.3.18-150300_59_43 fixes one issue.

    The following security issue was fixed:

    - CVE-2022-0435: Fixed remote stack overflow in net/tipc module that validate domain record count on input     (bsc#1195308).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1619 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0363-1 advisory.

  - The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a     vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. (CVE-2020-28097)

  - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through     crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected     versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)

  - In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a     race condition. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-160822094References: Upstream kernel (CVE-2021-39648)

  - In ufshcd_eh_device_reset_handler of ufshcd.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-194696049References: Upstream kernel (CVE-2021-39657)

  - A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
    This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory     object. (CVE-2021-44733)

  - pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
    (CVE-2021-45095)

  - A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local     denial of service. (CVE-2022-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5096 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2020-29374 Jann Horn of Google reported a flaw in Linux's     virtual memory management. A parent and child process initially share all their memory, but when either     writes to a shared page, the page is duplicated and unshared (copy-on-write). However, in case an     operation such as vmsplice() required the kernel to take an additional reference to a shared page, and a     copy-on-write occurs during this operation, the kernel might have accessed the wrong process's memory. For     some programs, this could lead to an information leak or data corruption. This issue was already fixed for     most architectures, but not on MIPS and System z. This update corrects that. CVE-2020-36322,     CVE-2021-28950 The syzbot tool found that the FUSE (filesystem-in-user-space) implementation did not     correctly handle a FUSE server returning invalid attributes for a file. A local user permitted to run a     FUSE server could use this to cause a denial of service (crash). The original fix for this introduced a     different potential denial of service (infinite loop in kernel space), which has also been fixed.
    CVE-2021-3640 Lin Ma discovered a race condiiton in the Bluetooth protocol implementation that can lead to     a use-after-free. A local user could exploit this to cause a denial of service (memory corruption or     crash) or possibly for privilege escalation. CVE-2021-3744, CVE-2021-3764 minihanshen reported bugs in the     ccp driver for AMD Cryptographic Coprocessors that could lead to a resource leak. On systems using this     driver, a local user could exploit this to cause a denial of service. CVE-2021-3752 Likang Luo of NSFOCUS     Security Team discovered a flaw in the Bluetooth L2CAP implementation that can lead to a user-after-free.
    A local user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-3760, CVE-2021-4202 Lin Ma discovered race conditions in the NCI (NFC     Controller Interface) driver, which could lead to a use-after-free. A local user could exploit this to     cause a denial of service (memory corruption or crash) or possibly for privilege escalation. This driver     is not enabled in Debian's official kernel configurations. CVE-2021-3772 A flaw was found in the SCTP     protocol implementation, which would allow a networked attacker to break an SCTP association. The attacker     would only need to know or guess the IP addresses and ports for the association. CVE-2021-4002 It was     discovered that hugetlbfs, the virtual filesystem used by applications to allocate huge pages in RAM, did     not flush the CPU's TLB in one case where it was necessary. In some circumstances a local user would be     able to read and write huge pages after they are freed and reallocated to a different process. This could     lead to privilege escalation, denial of service or information leaks. CVE-2021-4083 Jann Horn reported a     race condition in the local (Unix) sockets garbage collector, that can lead to use-after-free. A local     user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-4135 A flaw was found in the netdevsim driver which would lead to an     information leak. This driver is not enabled in Debian's official kernel configurations. CVE-2021-4155     Kirill Tkhai discovered a data leak in the way the XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for     a size increase of files with unaligned size. A local attacker can take advantage of this flaw to leak     data on the XFS filesystem. CVE-2021-4203 Jann Horn reported a race condition in the local (Unix) sockets     implementation that can lead to a use-after-free. A local user could exploit this to leak sensitive     information from the kernel. CVE-2021-20317 It was discovered that the timer queue structure could become     corrupt, leading to waiting tasks never being woken up. A local user with certain privileges could exploit     this to cause a denial of service (system hang). CVE-2021-20321 A race condition was discovered in the     overlayfs filesystem driver. A local user with access to an overlayfs mount and to its underlying upper     directory could exploit this for privilege escalation. CVE-2021-20322 An information leak was discovered     in the IPv4 implementation. A remote attacker could exploit this to quickly discover which UDP ports a     system is using, making it easier for them to carry out a DNS poisoning attack against that system.
    CVE-2021-22600 The syzbot tool found a flaw in the packet socket (AF_PACKET) implementation which could     lead to incorrectly freeing memory. A local user with CAP_NET_RAW capability (in any user namespace) could     exploit this for denial of service (memory corruption or crash) or possibly for privilege escalation.
    CVE-2021-28711, CVE-2021-28712, CVE-2021-28713 (XSA-391) Juergen Gross reported that malicious PV backends     can cause a denial of service to guests being serviced by those backends via high frequency events, even     if those backends are running in a less privileged environment. CVE-2021-28714, CVE-2021-28715 (XSA-392)     Juergen Gross discovered that Xen guests can force the Linux netback driver to hog large amounts of kernel     memory, resulting in denial of service. CVE-2021-38300 Piotr Krysiuk discovered a flaw in the classic BPF     (cBPF) JIT compiler for MIPS architectures. A local user could exploit this to excute arbitrary code in     the kernel. This issue is mitigated by setting sysctl net.core.bpf_jit_enable=0, which is the default. It     is *not* mitigated by disabling unprivileged use of eBPF. CVE-2021-39685 Szymon Heidrich discovered a     buffer overflow vulnerability in the USB gadget subsystem, resulting in information disclosure, denial of     service or privilege escalation. CVE-2021-39686 A race condition was discovered in the Android binder     driver, that could lead to incorrect security checks. On systems where the binder driver is loaded, a     local user could exploit this for privilege escalation. CVE-2021-39698 Linus Torvalds reported a flaw in     the file polling implementation, which could lead to a use-after-free. A local user could exploit this for     denial of service (memory corruption or crash) or possibly for privilege escalation. CVE-2021-39713 The     syzbot tool found a race condition in the network scheduling subsystem which could lead to a use-after-     free. A local user could exploit this for denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2021-41864 An integer overflow was discovered in the Extended BPF (eBPF)     subsystem. A local user could exploit this for denial of service (memory corruption or crash), or possibly     for privilege escalation. This can be mitigated by setting sysctl kernel.unprivileged_bpf_disabled=1,     which disables eBPF use by unprivileged users. CVE-2021-42739 A heap buffer overflow was discovered in the     firedtv driver for FireWire-connected DVB receivers. A local user with access to a firedtv device could     exploit this for denial of service (memory corruption or crash), or possibly for privilege escalation.
    CVE-2021-43389 The Active Defense Lab of Venustech discovered a flaw in the CMTP subsystem as used by     Bluetooth, which could lead to an out-of-bounds read and object type confusion. A local user with     CAP_NET_ADMIN capability in the initial user namespace could exploit this for denial of service (memory     corruption or crash), or possibly for privilege escalation. CVE-2021-43975 Brendan Dolan-Gavitt reported a     flaw in the hw_atl_utils_fw_rpc_wait() function in the aQuantia AQtion ethernet device driver which can     result in denial of service or the execution of arbitrary code. CVE-2021-43976 Zekun Shen and Brendan     Dolan-Gavitt discovered a flaw in the mwifiex_usb_recv() function of the Marvell WiFi-Ex USB Driver. An     attacker able to connect a crafted USB device can take advantage of this flaw to cause a denial of     service. CVE-2021-44733 A race condition was discovered in the Trusted Execution Environment (TEE)     subsystem for Arm processors, which could lead to a use-after-free. A local user permitted to access a TEE     device could exploit this for denial of service (memory corruption or crash) or possibly for privilege     escalation. CVE-2021-45095 It was discovered that the Phone Network protocol (PhoNet) driver has a     reference count leak in the pep_sock_accept() function. CVE-2021-45469 Wenqing Liu reported an out-of-     bounds memory access in the f2fs implementation if an inode has an invalid last xattr entry. An attacker     able to mount a specially crafted image can take advantage of this flaw for denial of service.
    CVE-2021-45480 A memory leak flaw was discovered in the __rds_conn_create() function in the RDS (Reliable     Datagram Sockets) protocol subsystem. CVE-2022-0001 (INTEL-SA-00598) Researchers at VUSec discovered that     the Branch History Buffer in Intel processors can be exploited to create information side channels with     speculative execution. This issue is similar to Spectre variant 2, but requires additional mitigations on     some processors. This can be exploited to obtain sensitive information from a different security context,     such as from user-space to the kernel, or from a KVM guest to the kernel. CVE-2022-0002 (INTEL-SA-00598)     This is a similar issue to CVE-2022-0001, but covers exploitation within a security context, such as from     JIT-compiled code in a sandbox to hosting code in the same process. This can be partly mitigated by     disabling eBPF for unprivileged users with the sysctl: kernel.unprivileged_bpf_disabled=2. This update     does that by default. CVE-2022-0322 Eiichi Tsukata discovered a flaw in the sctp_make_strreset_req()     function in the SCTP network protocol implementation which can result in denial of service. CVE-2022-0330     Sushma Venkatesh Reddy discovered a missing GPU TLB flush in the i915 driver, resulting in denial of     service or privilege escalation. CVE-2022-0435 Samuel Page and Eric Dumazet reported a stack overflow in     the networking module for the Transparent Inter-Process Communication (TIPC) protocol, resulting in denial     of service or potentially the execution of arbitrary code. CVE-2022-0487 A use-after-free was discovered     in the MOXART SD/MMC Host Controller support driver. This flaw does not impact the Debian binary packages     as CONFIG_MMC_MOXART is not set. CVE-2022-0492 Yiqi Sun and Kevin Wang reported that the cgroup-v1     subsystem does not properly restrict access to the release-agent feature. A local user can take advantage     of this flaw for privilege escalation and bypass of namespace isolation. CVE-2022-0617 butt3rflyh4ck     discovered a NULL pointer dereference in the UDF filesystem. A local user that can mount a specially     crafted UDF image can use this flaw to crash the system. CVE-2022-0644 Hao Sun reported a missing check     for file read permission in the finit_module() and kexec_file_load() system calls. The security impact of     this is unclear, since these system calls are usually only available to the root user. CVE-2022-22942 It     was discovered that wrong file file descriptor handling in the VMware Virtual GPU driver (vmwgfx) could     result in information leak or privilege escalation. CVE-2022-24448 Lyu Tao reported a flaw in the NFS     implementation in the Linux kernel when handling requests to open a directory on a regular file, which     could result in a information leak. CVE-2022-24959 A memory leak was discovered in the     yam_siocdevprivate() function of the YAM driver for AX.25, which could result in denial of service.
    CVE-2022-25258 Szymon Heidrich reported the USB Gadget subsystem lacks certain validation of interface OS     descriptor requests, resulting in memory corruption. CVE-2022-25375 Szymon Heidrich reported that the     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command, resulting in information leak     from kernel memory. For the oldstable distribution (buster), these problems have been fixed in version     4.19.232-1. This update additionally includes many more bug fixes from stable updates 4.19.209-4.19.232     inclusive. We recommend that you upgrade your linux packages. For the detailed security status of linux     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.27 / 5.15.27_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-067-01 advisory.

  - A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c     in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system     Confidentiality. This flaw affects kernel versions prior to 5.14 rc1. (CVE-2022-0487)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB     Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array     index and ones associated with NULL function pointer retrieval). Memory corruption might occur.
    (CVE-2022-25258)

  - An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive     information from kernel memory. (CVE-2022-25375)

  - net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges     because of a heap out-of-bounds write. This is related to nf_tables_offload. (CVE-2022-25636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0819 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)

    * kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

    * kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container     breakout (CVE-2021-4154)

    * kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

    * kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

    * kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

    * kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel symbol '__rt_mutex_init' is exported GPL-only in kernel 4.18.0-348.2.1.rt7.132.el8_5 (BZ#2038423)

    * kernel-rt: update RT source tree to the RHEL-8.5.z3 source tree (BZ#2045589)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:0825 advisory.

  - kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

  - kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container     breakout (CVE-2021-4154)

  - kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

  - kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

  - kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

  - kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

  - kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)

  - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.102-99.473. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-011 advisory.

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26401)

    An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (CVE-2021-47617)

    Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure. (CVE-2022-0001)

    Non-transparent sharing of branch predictor within a context in some Intel(r) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

    A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

    A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

    A use-after-free vulnerability was found in the tc_new_tfilter function in net/sched/cls_api.c in the     Linux kernel. The availability of local, unprivileged user namespaces allows privilege escalation.
    (CVE-2022-1055)

    The Amazon Linux kernel now enables, by default, a software mitigation for this issue, on all ARM-based     EC2 instance types. (CVE-2022-23960)

    A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: improve size validations for received domain records (CVE-2022-48711)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix error handling in ext4_fc_record_modified_inode() (CVE-2022-48712)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/pt: Fix crash with stop filters in single-range mode (CVE-2022-48713)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Use VM_MAP instead of VM_ALLOC for ringbuf (CVE-2022-48714)

    In the Linux kernel, the following vulnerability has been resolved:

    net: macsec: Fix offload support for NETDEV_UNREGISTER event (CVE-2022-48720)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (CVE-2022-48724)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ucma: Protect mc during concurrent multicast leaves (CVE-2022-48726)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/hfi1: Fix AIP early init panic (CVE-2022-48728)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock between quota disable and qgroup rescan worker (CVE-2022-48734)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: fix double free of cond_list on error paths (CVE-2022-48740)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (CVE-2022-48742)

    In the Linux kernel, the following vulnerability has been resolved:

    net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Use del_timer_sync in fw reset flow of halting poll (CVE-2022-48745)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix handling of wrong devices during bond netevent (CVE-2022-48746)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Forcibly leave nested virt when SMM state is toggled (CVE-2022-48763)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (CVE-2022-48775)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: remove vsock from connected table when connect is interrupted by a signal (CVE-2022-48786)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-rdma: fix possible use-after-free in transport error_recovery work (CVE-2022-48788)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: fix a possible use-after-free in controller reset during load (CVE-2022-48790)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix potential use-after-free during probe (CVE-2022-48796)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: don't try to NUMA-migrate COW pages that have other uses (CVE-2022-48797)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix list corruption in perf_cgroup_switch() (CVE-2022-48799)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/proc: task_mmu.c: don't read mapcount for migration entry (CVE-2022-48802)

    In the Linux kernel, the following vulnerability has been resolved:

    vt_ioctl: fix array_index_nospec in vt_setactivate (CVE-2022-48804)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (CVE-2022-48805)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix a memleak when uncloning an skb dst and its metadata (CVE-2022-48809)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (CVE-2022-48810)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: lantiq_gswip: don't use devres for mdiobus (CVE-2022-48812)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: felix: don't use devres for mdiobus (CVE-2022-48813)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: bcm_sf2: don't use devres for mdiobus (CVE-2022-48815)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: ar9331: register the mdiobus under devres (CVE-2022-48817)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: mv88e6xxx: don't use devres for mdiobus (CVE-2022-48818)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedf: Fix refcount issue when LOGO is received during TMF (CVE-2022-48823)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedf: Add stag_work to all the vports (CVE-2022-48825)

    A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.
    This issue may allow a local attacker with user privilege to cause a denial of service. (CVE-2023-1582)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has kernel packages installed that are affected by multiple vulnerabilities:

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through     crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected     versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 (CVE-2021-22600)

  - A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device     driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A     local user could use this flaw to get unauthorized access to some data. (CVE-2021-4135)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
158822	RHEL 8 : kernel (RHSA-2022:0825)	Nessus	Red Hat Local Security Checks	2022/3/11	2026/6/3	high
159184	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9245)	Nessus	Oracle Linux Local Security Checks	2022/3/23	2026/6/3	high
159186	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9244)	Nessus	Oracle Linux Local Security Checks	2022/3/23	2026/6/3	high
159395	Ubuntu 20.04 LTS : Linux kernel (Intel IOTG) vulnerabilities (USN-5362-1)	Nessus	Ubuntu Local Security Checks	2022/4/1	2026/6/3	high
160190	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9313)	Nessus	Oracle Linux Local Security Checks	2022/4/25	2026/6/3	high
179417	AlmaLinux 8 : kernel (ALSA-2022:0825)	Nessus	Alma Linux Local Security Checks	2023/8/7	2026/6/3	high
202093	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2362-1)	Nessus	SuSE Local Security Checks	2024/7/10	2025/9/26	high
158122	SUSE SLES15: kernel-livepatch-5_3_18-150300_59_43-default / etc (SUSE-SU-2022:0429-1)	Nessus	SuSE Local Security Checks	2022/2/17	2026/6/26	high
160288	RHEL 8 : kpatch-patch (RHSA-2022:1619)	Nessus	Red Hat Local Security Checks	2022/4/28	2024/11/8	high
157890	openSUSE 15 Security Update : kernel (openSUSE-SU-2022:0363-1)	Nessus	SuSE Local Security Checks	2022/2/11	2023/11/9	high
158761	Debian DSA-5096-1 : linux - security update	Nessus	Debian Local Security Checks	2022/3/9	2026/6/3	high
158743	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2022-067-01)	Nessus	Slackware Local Security Checks	2022/3/9	2026/6/3	high
158808	RHEL 8 : kernel-rt (RHSA-2022:0819)	Nessus	Red Hat Local Security Checks	2022/3/11	2026/6/3	high
159302	CentOS 8 : kernel (CESA-2022:0825)	Nessus	CentOS Local Security Checks	2022/3/29	2026/6/3	high
160425	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-011 (ALASKERNEL-5.10-2022-011)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2026/2/26	high
301229	NewStart CGSL MAIN 6.06 (SP) : kernel Multiple Vulnerabilities (NS-SA-2026-0008)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/6/3	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high