The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2736 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds     (CVE-2021-33656)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * media: em28xx: initialize refcount before kref_get (CVE-2022-3239)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * Executable Space Protection Bypass (CVE-2022-25265)

    * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * Soft lockup occurred during __page_mapcount (CVE-2023-1582)

    * slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e4460c41bc advisory.

    The 6.0.11 stable kernel update contains a number of important fixes across the tree.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0770-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
    - CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when     clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
    - CVE-2023-0597: Fixed lack of randomization of  per-cpu entry area in x86/mm (bsc#1207845).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-23559: Fixed integer overflow in rndis_wlan that leads to a buffer overflow (bsc#1207051).
    - CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6096-1 advisory.

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer     dereference in some situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-4842)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds write vulnerability. A local attacker could     use this to cause a denial of service (system crash). (CVE-2022-48423)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2022-48424)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer     lengths, leading to a heap-based buffer overflow. A remote attacker could possibly use this to cause a     denial of service (system crash). (CVE-2023-0210)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in     some situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2023-1652)

    It was discovered that the ARM64 EFI runtime services implementation in the Linux kernel did not properly     manage concurrency calls. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-21102)

    It was discovered that a race condition existed in Adreno GPU DRM driver in the Linux kernel, leading to a     double-free vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2023-21106)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    Kyle Zeng discovered that the class-based queuing discipline implementation in the Linux kernel contained     a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23454)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     the size of attributes when parsing MFT. A local attacker could possibly use this to cause a denial of     service (system crash) or expose sensitive information (kernel memory). (CVE-2023-26544)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6134-1 advisory.

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel did not     properly perform filter deactivation in some situations. A local attacker could possibly use this to gain     elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier     has been removed. (CVE-2023-1829)

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2023-1281)

    It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up     operation in some conditions. A local attacker could possibly use this to gain elevated privileges.
    (CVE-2023-0386)

    It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute     instructions using a return address from a sibling thread. A local attacker could possibly use this to     expose sensitive information. (CVE-2022-27672)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    It was discovered that the NTFS file system implementation in the Linux kernel contained a null pointer     dereference in some situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-4842)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the NFS implementation in the Linux kernel did not properly handle pending tasks in     some situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2023-1652)

    It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-1872)

    It was discovered that the Android Binder IPC subsystem in the Linux kernel did not properly validate     inputs in some situations, leading to a use- after-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-20938)

    It was discovered that the ARM64 EFI runtime services implementation in the Linux kernel did not properly     manage concurrency calls. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-21102)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2148 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * lockdown bypass using IMA (CVE-2022-21505)

    * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * denial of service in tipc_conn_close (CVE-2023-1382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2458 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * lockdown bypass using IMA (CVE-2022-21505)

    * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * denial of service in tipc_conn_close (CVE-2023-1382)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2458 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A use-after-free flaw was found in the Linux kernel's pipes functionality in how a user performs     manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1882)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the     identifier assigned to this vulnerability. (CVE-2022-3619)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges. (CVE-2022-3628)

  - A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function     l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads     to use after free. It is recommended to apply a patch to fix this issue. The identifier of this     vulnerability is VDB-211944. (CVE-2022-3640)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing     the subflow list at disconnect time. A local user could use this flaw to potentially crash the system     causing a denial of service. (CVE-2022-4128)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)     (CVE-2022-21505)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2148 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A use-after-free flaw was found in the Linux kernel's pipes functionality in how a user performs     manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-1882)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability. (CVE-2022-3524)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211918 is the     identifier assigned to this vulnerability. (CVE-2022-3619)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability. (CVE-2022-3625)

  - A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs     when a user connects to a malicious USB device. This can allow a local user to crash the system or     escalate their privileges. (CVE-2022-3628)

  - A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function     l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads     to use after free. It is recommended to apply a patch to fix this issue. The identifier of this     vulnerability is VDB-211944. (CVE-2022-3640)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing     the subflow list at disconnect time. A local user could use this flaw to potentially crash the system     causing a denial of service. (CVE-2022-4128)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with tc qdisc and tc class commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local     privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or     CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a     use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can     install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this     socket is disconnected and reused as a listener. If a new socket is created from the listener, the context     is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend     upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c (CVE-2023-0461)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)     (CVE-2022-21505)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2023:1690294029 advisory.

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

  - A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State     (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a     malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason     SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape     scenario. (CVE-2021-4093)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2023:1690287378 advisory.

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

  - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing     permission check. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-234475629References: Upstream kernel (CVE-2022-20572)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0438 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 9.2. It addresses 135 CVEs:
    CVE-2022-41674, CVE-2022-30594, CVE-2022-2959, CVE-2023-52628, CVE-2025-21727, and 130 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12255 advisory.

    - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions (Tom Lendacky)  [Orabug:
    35166671]  {CVE-2022-27672}
    - KVM: x86: Mitigate the cross-thread return address predictions bug (Tom Lendacky)  [Orabug: 35166671]     {CVE-2022-27672}
    - x86/speculation: Identify processors vulnerable to SMT RSB predictions (Tom Lendacky)  [Orabug:
    35166671]  {CVE-2022-27672}
    - drm/amdkfd: Check for null pointer after calling kmemdup (Jiasheng Jiang)  [Orabug: 34951503]     {CVE-2022-3108}
    - KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS (Jim Mattson) [Orabug: 34982694]     {CVE-2022-2196}
    - l2tp: Serialize access to sk_user_data with sk_callback_lock (Jakub Sitnicki) [Orabug: 34951575]     {CVE-2022-4129}
    - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) [Orabug: 35037713]     {CVE-2023-23559}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
175866	RHEL 8 : kernel-rt (RHSA-2023:2736)	Nessus	Red Hat Local Security Checks	2023/5/16	2025/9/10	high
211191	Fedora 37 : kernel (2022-e4460c41bc)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
172638	SUSE SLED12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:0770-1)	Nessus	SuSE Local Security Checks	2023/3/17	2026/6/26	high
176226	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6096-1)	Nessus	Ubuntu Local Security Checks	2023/5/23	2024/8/27	high
176616	Ubuntu 20.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6134-1)	Nessus	Ubuntu Local Security Checks	2023/6/2	2025/7/4	high
175460	RHEL 9 : kernel-rt (RHSA-2023:2148)	Nessus	Red Hat Local Security Checks	2023/5/13	2025/9/10	high
175477	RHEL 9 : kernel (RHSA-2023:2458)	Nessus	Red Hat Local Security Checks	2023/5/13	2025/9/10	high
175604	AlmaLinux 9 : kernel (ALSA-2023:2458)	Nessus	Alma Linux Local Security Checks	2023/5/14	2024/1/16	high
175629	AlmaLinux 9 : kernel-rt (ALSA-2023:2148)	Nessus	Alma Linux Local Security Checks	2023/5/14	2024/1/16	high
366945	CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2023:1690294029)	Nessus	CentOS Local Security Checks	2026/10/18	2026/10/19	low
366950	CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2023:1690287378)	Nessus	CentOS Local Security Checks	2026/10/18	2026/10/19	low
356103	Rocky Linux 9.2 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-64k / kernel-64k-core / etc Multiple Vulnerabilities (ciqsa-2026_0438)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/20	critical
174419	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2023-12255)	Nessus	Oracle Linux Local Security Checks	2023/4/17	2026/2/9	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

low

low

critical

high