The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5813-1 advisory.

    It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC     messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-43945)

    Tams Koczka discovered that the Bluetooth L2CAP handshake implementation in the Linux kernel contained     multiple use-after-free vulnerabilities. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-42896)

    It was discovered that the Xen netback driver in the Linux kernel did not properly handle packets     structured in certain ways. An attacker in a guest VM could possibly use this to cause a denial of service     (host NIC availability). (CVE-2022-3643)

    It was discovered that an integer overflow vulnerability existed in the Bluetooth subsystem in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2022-45934)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5861-1 advisory.

    It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC     messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-43945)

    Tams Koczka discovered that the Bluetooth L2CAP handshake implementation in the Linux kernel contained     multiple use-after-free vulnerabilities. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-42896)

    It was discovered that an out-of-bounds write vulnerability existed in the Video for Linux 2 (V4L2)     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-20369)

    Pawan Kumar Gupta, Alyssa Milburn, Amit Peled, Shani Rehana, Nir Shildan and Ariel Sabba discovered that     some Intel processors with Enhanced Indirect Branch Restricted Speculation (eIBRS) did not properly handle     RET instructions after a VM exits. A local attacker could potentially use this to expose sensitive     information. (CVE-2022-26373)

    David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel     incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this     to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

    Johannes Wikner and Kaveh Razavi discovered that for some AMD x86-64 processors, the branch predictor     could by mis-trained for return instructions in certain circumstances. A local attacker could possibly use     this to expose sensitive information. (CVE-2022-29900)

    Johannes Wikner and Kaveh Razavi discovered that for some Intel x86-64 processors, the Linux kernel's     protections against speculative branch target injection attacks were insufficient in some circumstances. A     local attacker could possibly use this to expose sensitive information. (CVE-2022-29901)

    It was discovered that the Xen netback driver in the Linux kernel did not properly handle packets     structured in certain ways. An attacker in a guest VM could possibly use this to cause a denial of service     (host NIC availability). (CVE-2022-3643)

    It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. An attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2022-3646)

    Khalid Masum discovered that the NILFS2 file system implementation in the Linux kernel did not properly     handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-3649)

    Hyunwoo Kim discovered that an integer overflow vulnerability existed in the PXA3xx graphics driver in the     Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2022-39842)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    It was discovered that the USB monitoring (usbmon) component in the Linux kernel did not properly set     permissions on memory mapped in to user space processes. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-43750)

    It was discovered that an integer overflow vulnerability existed in the Bluetooth subsystem in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2022-45934)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5914-1 advisory.

    It was discovered that the Upper Level Protocol (ULP) subsystem in the Linux kernel did not properly     handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-0461)

    It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC     messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-43945)

    Tams Koczka discovered that the Bluetooth L2CAP handshake implementation in the Linux kernel contained     multiple use-after-free vulnerabilities. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-42896)

    It was discovered that the IPv6 implementation in the Linux kernel contained a data race condition. An     attacker could possibly use this to cause undesired behaviors. (CVE-2022-3567)

    It was discovered that the NFSD implementation in the Linux kernel contained a use-after-free     vulnerability. A remote attacker could possibly use this to cause a denial of service (system crash) or     execute arbitrary code. (CVE-2022-4379)

    It was discovered that an integer overflow vulnerability existed in the Bluetooth subsystem in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2022-45934)

    It was discovered that the Atmel WILC1000 driver in the Linux kernel did not properly validate offsets,     leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service     (system crash). (CVE-2022-47520)

    Jos Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did     not properly protect against indirect branch prediction attacks in some situations. A local attacker could     possibly use this to expose sensitive information. (CVE-2023-0045)

    It was discovered that the io_uring subsystem in the Linux kernel contained a use-after-free     vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or     execute arbitrary code. (CVE-2023-0469)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3349 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3349-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     March 02, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.162-1~deb10u1     CVE ID         : CVE-2022-2873 CVE-2022-3545 CVE-2022-3623 CVE-2022-4696                      CVE-2022-36280 CVE-2022-41218 CVE-2022-45934 CVE-2022-47929                      CVE-2023-0179 CVE-2023-0240 CVE-2023-0266 CVE-2023-0394                      CVE-2023-23454  CVE-2023-23455 CVE-2023-23586     Debian Bug     : 825141 1008501 1027430 1027483

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2022-2873

        Zheyu Ma discovered that an out-of-bounds memory access flaw in         the Intel iSMT SMBus 2.0 host controller driver may result in         denial of service (system crash).

    CVE-2022-3545

        It was discovered that the Netronome Flow Processor (NFP) driver         contained a use-after-free flaw in area_cache_get(), which may         result in denial of service or the execution of arbitrary code.

    CVE-2022-3623

        A race condition when looking up a CONT-PTE/PMD size hugetlb page         may result in denial of service or an information leak.

    CVE-2022-4696

        A use-after-free vulnerability was discovered in the io_uring         subsystem.

    CVE-2022-36280

        An out-of-bounds memory write vulnerability was discovered in the         vmwgfx driver, which may allow a local unprivileged user to cause         a denial of service (system crash).

    CVE-2022-41218

        Hyunwoo Kim reported a use-after-free flaw in the Media DVB core         subsystem caused by refcount races, which may allow a local user         to cause a denial of service or escalate privileges.

    CVE-2022-45934

        An integer overflow in l2cap_config_req() in the Bluetooth         subsystem was discovered, which may allow a physically proximate         attacker to cause a denial of service (system crash).

    CVE-2022-47929

        Frederick Lawler reported a NULL pointer dereference in the         traffic control subsystem allowing an unprivileged user to cause a         denial of service by setting up a specially crafted traffic         control configuration.

    CVE-2023-0179

        Davide Ornaghi discovered incorrect arithmetics when fetching VLAN         header bits in the netfilter subsystem, allowing a local user to         leak stack and heap addresses or potentially local privilege         escalation to root.

    CVE-2023-0240

        A flaw was discovered in the io_uring subsystem that could lead         to a use-after-free.  A local user could exploit this to cause         a denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-0266

        A use-after-free flaw in the sound subsystem due to missing         locking may result in denial of service or privilege escalation.

    CVE-2023-0394

        Kyle Zeng discovered a NULL pointer dereference flaw in         rawv6_push_pending_frames() in the network subsystem allowing a         local user to cause a denial of service (system crash).

    CVE-2023-23454

        Kyle Zeng reported that the Class Based Queueing (CBQ) network         scheduler was prone to denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23455

        Kyle Zeng reported that the ATM Virtual Circuits (ATM) network         scheduler was prone to a denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23586

        A flaw was discovered in the io_uring subsystem that could lead to         an information leak.  A local user could exploit this to obtain         sensitive information from the kernel or other users.

    For Debian 10 buster, these problems have been fixed in version     5.10.162-1~deb10u1.

    This update also fixes Debian bugs #825141, #1008501, #1027430, and     #1027483, and includes many more bug fixes from stable updates     5.10.159-5.10.162 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c     has an integer wraparound via L2CAP_CONF_REQ packets. (CVE-2022-45934)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4573-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
    - CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
    - CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
    - CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect()     and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively)     remotely via Bluetooth (bsc#1205709).
    - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req()     which can be used to leak kernel pointers remotely (bsc#1205705).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the     efi firmware capsule-loader.c (bsc#1203322).
    - CVE-2022-3545: Fixed a use-after-free vulnerability is area_cache_get() of the file     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
    - CVE-2022-3521: Fixed a race condition in kcm_tx_work() of the file net/kcm/kcmsock.c (bsc#1204355).
    - CVE-2022-2153: Fixed a NULL pointer dereference in KVM when attempting to set a SynIC IRQ (bsc#1200788).
    - CVE-2022-33981: Fixed a denial of service, because of a concurrency use-after-free flaw after     deallocating raw_cmd in the raw_cmd_ioctl function (bsc#1200692).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4561-1 advisory.

    The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism     (bsc#1177282).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured (bsc#1202097).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the     efi firmware capsule-loader.c (bsc#1203322).
    - CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and     mgslpc_detach (bsc#1203987).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4589-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the     efi firmware capsule-loader.c (bsc#1203322).
    - CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory     (bsc#1205700).
    - CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when     clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
    - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect()     and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively)     remotely via Bluetooth (bsc#1205709).
    - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req()     which can be used to leak kernel pointers remotely (bsc#1205705).
    - CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection     and io_uring (bsc#1204228).
    - CVE-2022-3176: Fixed a use-after-free in io_uring related to signalfd_poll() and binder_poll()     (bsc#1203391).
    - CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).
    - CVE-2022-3625: Fixed a user-after-free vulnerability in devlink_param_set/devlink_param_get of the file     net/core/devlink.c (bsc#1204637).
    - CVE-2022-3535: Fixed a memory leak in mvpp2_dbgfs_port_init of the file     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bsc#1204417).
    - CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
    - CVE-2022-39189: Fixed an issue were an unprivileged guest users can compromise the guest kernel because     TLB flush operations were mishandled in certain KVM_VCPU_PREEMPTED situations (bsc#1203066).
    - CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c     (bsc#1204470).
    - CVE-2022-3521: Fixed a race condition in kcm_tx_work() of the file net/kcm/kcmsock.c (bsc#1204355).
    - CVE-2022-2153: Fixed a NULL pointer dereference in the KVM subsystem, when attempting to set a SynIC IRQ     (bsc#1200788).
    - CVE-2022-2978: Fixed a use-after-free in the NILFS file system (bsc#1202700).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4615-1 advisory.

    The SUSE Linux Enterprise 12  SP4 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
    - CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
    - CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
    - CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect()     and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively)     remotely via Bluetooth (bsc#1205709).
    - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req()     which can be used to leak kernel pointers remotely (bsc#1205705).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the     efi firmware capsule-loader.c (bsc#1203322).
    - CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
    - CVE-2022-3521: Fixed a race condition in kcm_tx_work() of the file net/kcm/kcmsock.c (bsc#1204355).
    - CVE-2022-2153: Fixed a NULL pointer dereference in the KVM subsystem, when attempting to set a SynIC IRQ     (bsc#1200788).
    - CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and     mgslpc_detach (bsc#1203987).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4504-1 advisory.

  - A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-23816)     (CVE-2022-2602)

  - There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a     waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before     the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free     to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We     recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659 (CVE-2022-3176)

  - A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability. (CVE-2022-3566)

  - A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability. (CVE-2022-3567)

  - A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue     is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation     leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the     identifier assigned to this vulnerability. (CVE-2022-3635)

  - Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC     interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It     appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol     headers are all contained within the linear section of the SKB and some NICs behave badly if this is not     the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x)     though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with     split headers, netback will forward those violating above mentioned assumption to the networking core,     resulting in said misbehavior. (CVE-2022-3643)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This     issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the     resources, causing denial of service or potentially crashing the system. (CVE-2022-3903)

  - A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in     drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and     gain escalation of privileges. (CVE-2022-4095)

  - A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service. (CVE-2022-4129)

  - An incorrect TLB flush issue was found in the Linux kernel's GPU i915 kernel driver, potentially leading     to random memory corruption or data leaks. This flaw could allow a local user to crash the system or     escalate their privileges on the system. (CVE-2022-4139)

  - roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a     report->value is in progress. (CVE-2022-41850)

  - A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

  - Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42328, CVE-2022-42329)

  - There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req     function which can be used to leak kernel pointers remotely. We recommend upgrading past commit     https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e     https://www.google.com/url (CVE-2022-42895)

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

  - The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer     overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send     buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer     to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC     message with garbage data is still correctly formed according to the specification and is passed forward     to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the     allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)

  - A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to     cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the     TDP MMU are enabled. (CVE-2022-45869)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race     condition and use-after-free during physical removal of a USB device. (CVE-2022-45888)

  - An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c     has an integer wraparound via L2CAP_CONF_REQ packets. (CVE-2022-45934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3403 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3403-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     May 3, 2023                                   https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux     Version        : 4.19.282-1     CVE ID         : CVE-2022-2873 CVE-2022-3424 CVE-2022-3545 CVE-2022-3707                      CVE-2022-4744 CVE-2022-36280 CVE-2022-41218 CVE-2022-45934                      CVE-2022-47929 CVE-2023-0045 CVE-2023-0266 CVE-2023-0394                      CVE-2023-0458 CVE-2023-0459 CVE-2023-0461 CVE-2023-1073                      CVE-2023-1074 CVE-2023-1078 CVE-2023-1079 CVE-2023-1118                      CVE-2023-1281 CVE-2023-1513 CVE-2023-1670 CVE-2023-1829                      CVE-2023-1855 CVE-2023-1859 CVE-2023-1989 CVE-2023-1990                      CVE-2023-1998 CVE-2023-2162 CVE-2023-2194 CVE-2023-23454                      CVE-2023-23455 CVE-2023-23559 CVE-2023-26545 CVE-2023-28328                      CVE-2023-30456 CVE-2023-30772     Debian Bug     : 825141

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service, or information     leak.

    CVE-2022-2873

        Zheyu Ma discovered that an out-of-bounds memory access flaw in         the Intel iSMT SMBus 2.0 host controller driver may result in         denial of service (system crash).

    CVE-2022-3424

        Zheng Wang and Zhuorao Yang reported a flaw in the SGI GRU driver         which could lead to a use-after-free.  On systems where this driver         is used, a local user can explit this for denial of service (crash         or memory corruption) or possibly for privilege escalation.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2022-3545

        It was discovered that the Netronome Flow Processor (NFP) driver         contained a use-after-free flaw in area_cache_get(), which may         result in denial of service or the execution of arbitrary code.

    CVE-2022-3707

        Zheng Wang reported a flaw in the i915 graphics driver's         virtualisation (GVT-g) support that could lead to a double-free.
        On systems where this feature is used, a guest can exploit this         for denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2022-4744

        The syzkaller tool found a flaw in the TUN/TAP network driver,         which can lead to a double-free.  A local user can exploit this         for denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2022-36280

        An out-of-bounds memory write vulnerability was discovered in the         vmwgfx driver, which may allow a local unprivileged user to cause         a denial of service (system crash).

    CVE-2022-41218

        Hyunwoo Kim reported a use-after-free flaw in the Media DVB core         subsystem caused by refcount races, which may allow a local user         to cause a denial of service or escalate privileges.

    CVE-2022-45934

        An integer overflow in l2cap_config_req() in the Bluetooth         subsystem was discovered, which may allow a physically proximate         attacker to cause a denial of service (system crash).

    CVE-2022-47929

        Frederick Lawler reported a NULL pointer dereference in the         traffic control subsystem allowing an unprivileged user to cause a         denial of service by setting up a specially crafted traffic         control configuration.

    CVE-2023-0045

        Rodrigo Branco and Rafael Correa De Ysasi reported that when a         user-space task told the kernel to enable Spectre v2 mitigation         for it, the mitigation was not enabled until the task was next         rescheduled.  This might be exploitable by a local or remote         attacker to leak sensitive information from such an application.

    CVE-2023-0266

        A use-after-free flaw in the sound subsystem due to missing         locking may result in denial of service or privilege escalation.

    CVE-2023-0394

        Kyle Zeng discovered a NULL pointer dereference flaw in         rawv6_push_pending_frames() in the network subsystem allowing a         local user to cause a denial of service (system crash).

    CVE-2023-0458

        Jordy Zimmer and Alexandra Sandulescu found that getrlimit() and         related system calls were vulnerable to speculative execution         attacks such as Spectre v1.  A local user could explot this to         leak sensitive information from the kernel.

    CVE-2023-0459

        Jordy Zimmer and Alexandra Sandulescu found a regression in         Spectre v1 mitigation in the user-copy functions for the amd64         (64-bit PC) architecture.  Where the CPUs do not implement SMAP or         it is disabled, a local user could exploit this to leak sensitive         information from the kernel.  Other architectures may also be         affected.

    CVE-2023-0461

        slipper reported a flaw in the kernel's support for ULPs (Upper         Layer Protocols) on top of TCP that can lead to a double-free when         using kernel TLS sockets.  A local user can exploit this for         denial of service (crash or memory corruption) or possibly for         privilege escalation.

        Kernel TLS is not enabled in Debian's official kernel         configurations.

    CVE-2023-1073

        Pietro Borrello reported a type confusion flaw in the HID (Human         Interface Device) subsystem.  An attacker able to insert and         remove USB devices might be able to use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1074

        Pietro Borrello reported a type confusion flaw in the SCTP         protocol implementation which can lead to a memory leak.  A local         user could exploit this to cause a denial of service (resource         exhaustion).

    CVE-2023-1078

        Pietro Borrello reported a type confusion flaw in the RDS protocol         implementation.  A local user could exploit this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-1079

        Pietro Borrello reported a race condition in the hid-asus HID         driver which could lead to a use-after-free.  An attacker able to         insert and remove USB devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1118

        Duoming Zhou reported a race condition in the ene_ir remote         control driver that can lead to a use-after-free if the driver         is unbound.  It is not clear what the security impact of this is.

    CVE-2023-1281, CVE-2023-1829

        valis reported two flaws in the cls_tcindex network traffic         classifier which could lead to a use-after-free.  A local user can         exploit these for privilege escalation.  This update removes         cls_tcindex entirely.

    CVE-2023-1513

        Xingyuan Mo reported an information leak in the KVM implementation         for the i386 (32-bit PC) architecture.  A local user could exploit         this to leak sensitive information from the kernel.

    CVE-2023-1670

        Zheng Wang reported a race condition in the xirc2ps_cs network         driver which can lead to a use-after-free.  An attacker able to         insert and remove PCMCIA devices can use this to cause a denial of         service (crash or memory corruption) or possibly to run arbitrary         code in the kernel.

    CVE-2023-1855

        Zheng Wang reported a race condition in the xgene-hwmon hardware         monitoring driver that may lead to a use-after-free.  It is not         clear what the security impact of this is.

    CVE-2023-1859

        Zheng Wang reported a race condition in the 9pnet_xen transport         for the 9P filesystem on Xen, which can lead to a use-after-free.
        On systems where this feature is used, a backend driver in another         domain can use this to cause a denial of service (crash or memory         corruption) or possibly to run arbitrary code in the vulnerable         domain.

    CVE-2023-1989

        Zheng Wang reported a race condition in the btsdio Bluetooth         adapter driver that can lead to a use-after-free.  An attacker         able to insert and remove SDIO devices can use this to cause a         denial of service (crash or memory corruption) or possibly to run         arbitrary code in the kernel.

    CVE-2023-1990

        Zheng Wang reported a race condition in the st-nci NFC adapter         driver that can lead to a use-after-free.  It is not clear what         the security impact of this is.

        This driver is not enabled in Debian's official kernel         configurations.

    CVE-2023-1998

        Jos Oliveira and Rodrigo Branco reported a regression in Spectre         v2 mitigation for user-space on x86 CPUs supporting IBRS but not         eIBRS.  This might be exploitable by a local or remote attacker to         leak sensitive information from a user-space application.

    CVE-2023-2162

        Mike Christie reported a race condition in the iSCSI TCP transport         that can lead to a use-after-free.  On systems where this feature         is used, a local user might be able to use this to cause a denial         of service (crash or memory corruption) or possibly for privilege         escalation.

    CVE-2023-2194

        Wei Chen reported a potential heap buffer overflow in the         i2c-xgene-slimpro IC adapter driver.  A local user with         permission to access such a device can use this to cause a denial         of service (crash or memory corruption) and probably for privilege         escalation.

    CVE-2023-23454

        Kyle Zeng reported that the Class Based Queueing (CBQ) network         scheduler was prone to denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23455

        Kyle Zeng reported that the ATM Virtual Circuits (ATM) network         scheduler was prone to a denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23559

        Szymon Heidrich reported incorrect bounds checks in the rndis_wlan         Wi-Fi driver which may lead to a heap buffer overflow or overread.
        An attacker able to insert and remove USB devices can use this to         cause a denial of service (crash or memory corruption) or         information leak, or possibly to run arbitrary code in the kernel.

    CVE-2023-26545

        Lianhui Tang reported a flaw in the MPLS protocol implementation         that could lead to a double-free.  A local user might be able to         exploit this to cause a denial of service (crash or memory         corruption) or possibl for privilege escalation.

    CVE-2023-28328

        Wei Chen reported a flaw in the az6927 DVB driver that can lead to         a null pointer dereference.  A local user permitted to access an         IC adapter device that this driver creates can use this to cause         a denial of service (crash).

    CVE-2023-30456

        Reima ISHII reported a flaw in the KVM implementation for Intel         CPUs affecting nested virtualisation.  When KVM was used as the L0         hypervisor, and EPT and/or unrestricted guest mode was disabled,         it did not prevent an L2 guest from being configured with an         architecturally invalid protection/paging mode.  A malicious guest         could exploit this to cause a denial of service (crash).

    CVE-2023-30772

        Zheng Wang reported a race condition in the da9150 charger driver         which could lead to a use-after-free.  It is not clear what the         security impact of this is.

        This driver is not enabled in Debian's official kernel         configurations.

    For Debian 10 buster, these problems have been fixed in version     4.19.282-1.  This update additionally fixes Debian bug #825141, and     includes many more bug fixes from stable updates 4.19.270-4.19.282     inclusive.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2950 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3138 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from     the References section.

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
170185	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5813-1)	Nessus	Ubuntu Local Security Checks	2023/1/20	2024/8/28	high
171361	Ubuntu 18.04 LTS : Linux kernel (Dell300x) vulnerabilities (USN-5861-1)	Nessus	Ubuntu Local Security Checks	2023/2/10	2024/8/27	high
172091	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5914-1)	Nessus	Ubuntu Local Security Checks	2023/3/4	2024/8/28	high
172079	Debian dla-3349 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	2023/3/3	2025/9/17	high
225048	Linux Distros Unpatched Vulnerability : CVE-2022-45934	Nessus	Misc.	2025/3/5	2025/10/28	high
168938	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:4573-1)	Nessus	SuSE Local Security Checks	2022/12/20	2025/9/24	high
168943	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:4561-1)	Nessus	SuSE Local Security Checks	2022/12/20	2025/9/24	high
168952	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:4589-1)	Nessus	SuSE Local Security Checks	2022/12/21	2025/9/25	high
169289	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:4615-1)	Nessus	SuSE Local Security Checks	2022/12/24	2025/9/25	high
168893	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:4504-1)	Nessus	SuSE Local Security Checks	2022/12/17	2024/1/15	high
175926	Debian dla-3403 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	2023/5/17	2025/1/22	high
197794	RHEL 8 : kernel-rt (RHSA-2024:2950)	Nessus	Red Hat Local Security Checks	2024/5/23	2025/9/25	critical
200558	RockyLinux 8 : kernel (RLSA-2024:3138)	Nessus	Rocky Linux Local Security Checks	2024/6/14	2025/9/26	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

critical

critical