The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3102 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3102-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     September 11, 2022                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.136-1~deb10u3     CVE ID         : CVE-2022-2585 CVE-2022-2586 CVE-2022-2588 CVE-2022-26373                      CVE-2022-29900 CVE-2022-29901 CVE-2022-36879 CVE-2022-36946

    Linux 5.10 has been packaged for Debian 10 as linux-5.10.  This     provides a supported upgrade path for systems that currently use     kernel packages from the buster-backports suite.

    There is no need to upgrade systems using Linux 4.19, as that kernel     version will also continue to be supported in the LTS period.

    The apt full-upgrade command will *not* automatically install the     updated kernel packages.  You should explicitly install one of the     following metapackages first, as appropriate for your system:

        linux-image-5.10-686         linux-image-5.10-686-pae         linux-image-5.10-amd64         linux-image-5.10-arm64         linux-image-5.10-armmp         linux-image-5.10-armmp-lpae         linux-image-5.10-cloud-amd64         linux-image-5.10-cloud-arm64         linux-image-5.10-rt-686-pae         linux-image-5.10-rt-amd64         linux-image-5.10-rt-arm64         linux-image-5.10-rt-armmp

    For example, if the command uname -r currently shows     5.10.0-0.deb10.16-amd64, you should install linux-image-5.10-amd64.

    This backport does not include the following binary packages:

        bpftool hyperv-daemons libcpupower-dev libcpupower1         linux-compiler-gcc-8-arm linux-compiler-gcc-8-x86 linux-cpupower         linux-libc-dev usbip

    Older versions of most of those are built from the linux source     package in Debian 10.

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2022-2585

        A use-after-free flaw in the implementation of POSIX CPU timers         may result in denial of service or in local privilege escalation.

    CVE-2022-2586

        A use-after-free in the Netfilter subsystem may result in local         privilege escalation for a user with the CAP_NET_ADMIN capability         in any user or network namespace.

    CVE-2022-2588

        Zhenpeng Lin discovered a use-after-free flaw in the cls_route         filter implementation which may result in local privilege         escalation for a user with the CAP_NET_ADMIN capability in any         user or network namespace.

    CVE-2022-26373

        It was discovered that on certain processors with Intel's Enhanced         Indirect Branch Restricted Speculation (eIBRS) capabilities there         are exceptions to the documented properties in some situations,         which may result in information disclosure.

        Intel's explanation of the issue can be found at         https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-     guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html

    CVE-2022-29900

        Johannes Wikner and Kaveh Razavi reported that for AMD/Hygon         processors, mis-trained branch predictions for return instructions         may allow arbitrary speculative code execution under certain         microarchitecture-dependent conditions.

        A list of affected AMD CPU types can be found at         https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037

    CVE-2022-29901

        Johannes Wikner and Kaveh Razavi reported that for Intel         processors (Intel Core generation 6, 7 and 8), protections against         speculative branch target injection attacks were insufficient in         some circumstances, which may allow arbitrary speculative code         execution under certain microarchitecture-dependent conditions.

        More information can be found at         https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-     guidance/advisory-guidance/return-stack-buffer-underflow.html

    CVE-2022-36879

        A flaw was discovered in xfrm_expand_policies in the xfrm         subsystem which can cause a reference count to be dropped twice.

    CVE-2022-36946

        Domingo Dirutigliano and Nicola Guerrera reported a memory         corruption flaw in the Netfilter subsystem which may result in         denial of service.

    For Debian 10 buster, these problems have been fixed in version     5.10.136-1~deb10u3. This update additionally includes many more bug     fixes from stable updates 5.10.128-5.10.136 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3294-1 advisory.

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the     machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector     (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (CVE-2022-21385)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from     the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length     heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary     code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged     code on the target system to exploit this vulnerability. (CVE-2022-2991)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3291-1 advisory.

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the     machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector     (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (CVE-2022-21385)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3408-1 advisory.

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the     machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector     (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (CVE-2022-21385)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3131 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3131-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     October 01, 2022                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.260-1     CVE ID         : CVE-2021-4159 CVE-2021-33655 CVE-2021-33656 CVE-2022-1462                      CVE-2022-1679 CVE-2022-2153 CVE-2022-2318 CVE-2022-2586                      CVE-2022-2588 CVE-2022-2663 CVE-2022-3028 CVE-2022-26365                      CVE-2022-26373 CVE-2022-33740 CVE-2022-33741 CVE-2022-33742                      CVE-2022-33744 CVE-2022-36879 CVE-2022-36946 CVE-2022-39188                      CVE-2022-39842 CVE-2022-40307     Debian Bug     : 1018752

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to privilege escalation, denial of service or information     leaks.

    CVE-2021-4159

        A flaw was found in the eBPF verifier which could lead to an         out-of-bounds read.  If unprivileged use of eBPF is enabled, this         could leak sensitive information.  This was already disabled by         default, which would fully mitigate the vulnerability.

    CVE-2021-33655

        A user with access to a framebuffer console device could cause a         memory out-of-bounds write via the FBIOPUT_VSCREENINFO ioctl.

    CVE-2021-33656

        A user with access to a framebuffer console device could cause a         memory out-of-bounds write via some font setting ioctls.  These         obsolete ioctls have been removed.

    CVE-2022-1462

         reported a race condition in the pty (pseudo-terminal)         subsystem that can lead to a slab out-of-bounds write.  A local         user could exploit this to cause a denial of service (crash or         memory corruption) or possibly for privilege escalation.

    CVE-2022-1679

        The syzbot tool found a race condition in the ath9k_htc driver         which can lead to a use-after-free.  This might be exploitable to         cause a denial service (crash or memory corruption) or possibly         for privilege escalation.

    CVE-2022-2153

        kangel reported a flaw in the KVM implementation for x86         processors which could lead to a null pointer dereference. A local         user permitted to access /dev/kvm could exploit this to cause a         denial of service (crash).

    CVE-2022-2318

        A use-after-free in the Amateur Radio X.25 PLP (Rose) support may         result in denial of service.

    CVE-2022-2586

        A use-after-free in the Netfilter subsystem may result in local         privilege escalation for a user with the CAP_NET_ADMIN capability         in any user or network namespace.

    CVE-2022-2588

        Zhenpeng Lin discovered a use-after-free flaw in the cls_route         filter implementation which may result in local privilege         escalation for a user with the CAP_NET_ADMIN capability in any         user or network namespace.

    CVE-2022-2663

        David Leadbeater reported flaws in the nf_conntrack_irc         connection-tracking protocol module.  When this module is enabled         on a firewall, an external user on the same IRC network as an         internal user could exploit its lax parsing to open arbitrary TCP         ports in the firewall, to reveal their public IP address, or to         block their IRC connection at the firewall.

    CVE-2022-3028

        Abhishek Shah reported a race condition in the AF_KEY subsystem,         which could lead to an out-of-bounds write or read.  A local user         could exploit this to cause a denial of service (crash or memory         corruption), to obtain sensitive information, or possibly for         privilege escalation.

    CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742

        Roger Pau Monne discovered that Xen block and network PV device         frontends don't zero out memory regions before sharing them with         the backend, which may result in information disclosure.
        Additionally it was discovered that the granularity of the grant         table doesn't permit sharing less than a 4k page, which may also         result in information disclosure.

    CVE-2022-26373

        It was discovered that on certain processors with Intel's Enhanced         Indirect Branch Restricted Speculation (eIBRS) capabilities there         are exceptions to the documented properties in some situations,         which may result in information disclosure.

        Intel's explanation of the issue can be found at         https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-     guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html

    CVE-2022-33744

        Oleksandr Tyshchenko discovered that ARM Xen guests can cause a         denial of service to the Dom0 via paravirtual devices.

    CVE-2022-36879

        A flaw was discovered in xfrm_expand_policies in the xfrm         subsystem which can cause a reference count to be dropped twice.

    CVE-2022-36946

        Domingo Dirutigliano and Nicola Guerrera reported a memory         corruption flaw in the Netfilter subsystem which may result in         denial of service.

    CVE-2022-39188

        Jann Horn reported a race condition in the kernel's handling of         unmapping of certain memory ranges.  When a driver created a         memory mapping with the VM_PFNMAP flag, which many GPU drivers do,         the memory mapping could be removed and freed before it was         flushed from the CPU TLBs.  This could result in a page use-after-         free.  A local user with access to such a device could exploit         this to cause a denial of service (crash or memory corruption) or         possibly for privilege escalation.

    CVE-2022-39842

        An integer overflow was discovered in the pxa3xx-gcu video driver         which could lead to a heap out-of-bounds write.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-40307

        A race condition was discovered in the EFI capsule-loader driver,         which could lead to use-after-free.  A local user permitted to         access this device (/dev/efi_capsule_loader) could exploit this to         cause a denial of service (crash or memory corruption) or possibly         for privilege escalation.  However, this device is normally only         accessible by the root user.

    For Debian 10 buster, these problems have been fixed in version     4.19.260-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.294-220.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1852 advisory.

    An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver     functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data. This flaw allows a     local user to crash or potentially escalate their privileges on the system. (CVE-2021-33655)

    A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace.  A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. (CVE-2021-4159)

    An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A flaw was found in the Linux kernel's networking code. A use-after-free was found in the way the sch_sfb     enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed)     into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of     service. (CVE-2022-3586)

    A memory access flaw was found in the Linux kernel's XEN hypervisor for the virtual machine. This flaw     allows a local user to crash the system or potentially escalate their privileges on the system.
    (CVE-2022-36123)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: mpt3sas: Fix use-after-free warning (CVE-2022-48695)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/radeon: add a force flush to delay work when radeon (CVE-2022-48704)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Prevent nested device-reset calls (CVE-2022-49936)

    In the Linux kernel, the following vulnerability has been resolved:

    vt: Clear selection before changing the font (CVE-2022-49948)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: hidraw: fix memory leak in hidraw_release() (CVE-2022-49981)

    In the Linux kernel, the following vulnerability has been resolved:

    md: call __md_stop_writes in md_stop (CVE-2022-49987)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: Check for overflow while configuring loop (CVE-2022-49993)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix refcount leak in __xfrm_policy_check() (CVE-2022-50007)

    In the Linux kernel, the following vulnerability has been resolved:

    kprobes: don't call disarm_kprobe() for disabled kprobes (CVE-2022-50008)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-204450605References: Upstream kernel (CVE-2021-39634)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux     Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
    (CVE-2022-0812)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

  - It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0. (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - An out-of-bounds memory access flaw was found in the Linux kernel Intel's iSMT SMBus host controller     driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input     data. This flaw allows a local user to crash the system. (CVE-2022-2873)

  - A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is     disabled by default, it could allow an attacker to crash the system or have other memory-corruption side     effects. (CVE-2022-2938)

  - A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
164947	Debian dla-3102 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	2022/9/12	2025/1/22	high
165232	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:3294-1)	Nessus	SuSE Local Security Checks	2022/9/17	2024/1/15	high
165234	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3291-1)	Nessus	SuSE Local Security Checks	2022/9/17	2023/7/14	high
165501	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3408-1)	Nessus	SuSE Local Security Checks	2022/9/27	2023/7/13	high
165623	Debian dla-3131 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	2022/10/2	2025/1/22	high
165990	Amazon Linux 2 : kernel, --advisory ALAS2-2022-1852 (ALAS-2022-1852)	Nessus	Amazon Linux Local Security Checks	2022/10/10	2026/2/24	high
169738	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2023-1223)	Nessus	Huawei Local Security Checks	2023/1/10	2024/6/26	high

检测

插件搜索

high

high

high

high

high

high

high