The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3897-1 advisory.

    The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bnc#1198702).
    - CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to     cause DoS (bnc#1200788).
    - CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686     bsc#1196018).
    - CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege     escalation or DoS (bnc#1202700).
    - CVE-2022-3169: Fixed a denial of service flaw which occurs when consecutive requests to NVME_IOCTL_RESET     and the NVME_IOCTL_SUBSYS_RESET are sent (bnc#1203290).
    - CVE-2022-3176: Fixed use-after-free in io_uring when using POLLFREE (bnc#1203391).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
    - CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bnc#1204402).
    - CVE-2022-3545: Fixed use-after-free in area_cache_get() in     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
    - CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local     privilege escalation or DoS (bnc#1204470).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bnc#1204439).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bnc#1204574).
    - CVE-2022-3623: Fixed race condition in follow_page_pte() (mm/gup.c) (bsc#1204575).
    - CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c     (bnc#1204637).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
    - CVE-2022-39189: Fixed a flaw in the x86 KVM subsystem that could allow unprivileged guest users to     compromise the guest kernel via TLB flush operations on preempted vCPU (bnc#1203066).
    - CVE-2022-40768: Fixed information disclosure in stex_queuecommand_lck (bnc#1203514).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
    - CVE-2022-42719: Fixed MBSSID parsing use-after-free. (bsc#1204051)
    - CVE-2022-42720: Fixed BSS refcounting bugs. (bsc#1204059)
    - CVE-2022-42721: Avoid nontransmitted BSS list corruption. (bsc#1204060)
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bnc#1204653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3930-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel RT was updated.

    The following security bugs were fixed:

    - CVE-2022-3628: Fixed potential buffer overflow in  brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bnc#1198702).
    - CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to     cause DoS (bnc#1200788).
    - CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686     bsc#1196018).
    - CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bnc#1204402).
    - CVE-2022-3545: Fixed use-after-free in area_cache_get() in     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bnc#1204439).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bnc#1204574).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bnc#1204653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3929-1 advisory.

    The SUSE Linux Enterprise 15-SP3 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-2964, CVE-2022-28748: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686     bsc#1196018).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bnc#1198702).
    - CVE-2022-2153: Fixed vulnerability in KVM that could allow an unprivileged local attacker on the host to     cause DoS (bnc#1200788).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
    - CVE-2022-2978: Fixed use-after-free in the NILFS file system that could lead to local privilege     escalation or DoS (bnc#1202700).
    - CVE-2022-3176: Fixed use-after-free in io_uring when using POLLFREE (bnc#1203391).
    - CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3535: Fixed memory leak in mvpp2_dbgfs_port_init() in     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bnc#1204417).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bnc#1204402).
    - CVE-2022-3545: Fixed use-after-free in area_cache_get() in     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
    - CVE-2022-3577: Fixed out-of-bounds memory write flaw in bigben device driver that could lead to local     privilege escalation or DoS (bnc#1204470).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bnc#1204439).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bnc#1204479).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bnc#1204574).
    - CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c     (bnc#1204637).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bnc#1204635).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bnc#1204647).
    - CVE-2022-39189: Fixed a flaw in the x86 KVM subsystem that could allow unprivileged guest users to     compromise the guest kernel via TLB flush operations on preempted vCPU (bnc#1203066).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bnc#1204653).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4072-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2022-28748: Fixed a leak of kernel memory over the network by ax88179_178a devices (bsc#1196018).
    - CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or     potentially escalate their privileges on the system (bsc#1199904).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bnc#1202686).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-33981: Fixed a use-after-free in floppy driver (bnc#1200692).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c     (bsc#1204171).
    - CVE-2022-3521: Fixed race condition in kcm_tx_work() in net/kcm/kcmsock.c (bnc#1204355).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bnc#1204354).
    - CVE-2022-3526: Fixed a memory leak in macvlan_handle_frame() from drivers/net/macvlan.c (bnc#1204353).
    - CVE-2022-3545: Fixed use-after-free in area_cache_get() in     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bnc#1204415).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bnc#1204431).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bnc#1204574).
    - CVE-2022-3625: Fixed use-after-free in devlink_param_set()/devlink_param_get() in net/core/devlink.c     (bnc#1204637).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bnc#1204619).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bnc#1204646).
    - CVE-2022-40476: Fixed a null pointer dereference in fs/io_uring.c (bnc#1203435).
    - CVE-2022-40768: Fixed information disclosure in stex_queuecommand_lck (bnc#1203514).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space  client to corrupt the monitor's     internal memory (bnc#1204653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0512 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL-9.1: Update new rfkill event size behavior for compatibility with older applications (BZ#2098082)

    * RHEL9 - ISST-LTE:LPM:Rainer/P9:HPT:SLES15SP4:After successful migration with hardlockups ,LPM failed and     LPAR remained hung (BZ#2103084)

    * Intel 9.1, ADL-P IOTG: rmmod of pmt_telemetry driver results in panic (BZ#2127863)

    * kernel: Update ppc64le key following resolution of CVE-2022-1665 (BZ#2130923)

    * MCHP 9.1: Update SmartPQI driver to latest upstream Second Set of Patches (BZ#2133552)

    * intel_qat: WARNING: CPU: 0 PID: 1440 at kernel/dma/debug.c:973 check_unmap+0xa6f/0x2360 (BZ#2133750)

    * CNB: Update TC subsystem to upstream v5.18 (BZ#2137359)

    * netfilter: backports from upstream (BZ#2137360)

    * netfilter: backports from upstream (BZ#2137361)

    * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on     the system. (BZ#2143767)

    * RHEL 9: ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143977)

    * RHEL 9.0, AMD Genoa: OS cannot boot when enabling SME in UEFI setup and appending 'mem_encrypt=on'     (BZ#2145017)

    * kernel-devel RPM cross-compiled by CKI contains host-arch scripts (BZ#2150019)

    * Azure, RHEL 9: Sometimes newly deployed VMs are not getting accelerated network during provisioning     (BZ#2151606)

    * Scheduler Update (rhel9.2) (BZ#2153793)

    * DELL 9.0 RT BUG - stock clone: On PE R760 system, call traces are observed dmesg when system is running     stress (BZ#2154408)

    * MSFT, MANA RHEL 9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155146)

    * Azure, RHEL 9: VM Deployment Failures Patch Request (BZ#2155931)

    * kernel-rt-debug: WARNING: possible circular locking dependency detected     (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160615)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0334 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959)

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945)

    * kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077)

    * kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Intel 9.2: Important iavf bug fixes (BZ#2127884)

    * vfio zero page mappings fail after 2M instances (BZ#2128514)

    * nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359)

    * ice: Driver Update to 5.19 (BZ#2132070)

    * WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588)

    * drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619)

    * updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914)

    * DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213)

    * No signal showed in the VGA monitor when installing RHEL9 in the legacy bios mode (BZ#2140153)

    * Practically limit Dummy wait workaround to old Intel systems (BZ#2142168)

    * ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976)

    * fatal error: error in backend: Branch target out of insn range (BZ#2144902)

    * AMdCLIENT: The kernel command line parameter nomodeset not working properly (BZ#2145217)

    * Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910)

    * Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning     (BZ#2151605)

    * DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress     (BZ#2154407)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.5.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.5.3 advisory.

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf;
    Oracle GraalVM Enterprise Edition: 20.3.8 and 21.3.4. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2023-21830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2940-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
    - CVE-2024-39506: liquidio: adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
    - CVE-2021-47619: i40e: Fix queues reservation for XDP (bsc#1226645).
    - CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743).
    - CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705).
    - CVE-2024-42223: media: dvb-frontends: tda10048: Fix integer overflow (bsc#1228726)
    - CVE-2024-42119: drm/amd/display: Skip finding free audio for unknown engine_id (bsc#1228584)
    - CVE-2024-42120: drm/amd/display: Check pipe offset before setting vblank (bsc#1228588)
    - CVE-2024-41095: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes (bsc#1228662)
    - CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723).
    - CVE-2024-41072: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (bsc#1228626).
    - CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565).
    - CVE-2024-40995: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (bsc#1227830).
    - CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
    - CVE-2024-41066: ibmvnic: add tx check to prevent skb leak (bsc#1228640).
    - CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
    - CVE-2024-41089: drm/nouveau/dispnv04: fix null pointer dereference in (bsc#1228658)
    - CVE-2024-41060: drm/radeon: check bo_va->bo is non-NULL before using it (bsc#1228567)
    - CVE-2022-48829: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (bsc#1228055).
    - CVE-2022-48828: NFSD: Fix ia_size underflow (bsc#1228054).
    - CVE-2022-48827: NFSD: Fix the behavior of READ near OFFSET_MAX (bsc#1228037).
    - CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
    - CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing     (bsc#1228625).
    - CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
    - CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
    - CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617).
    - CVE-2024-40978: scsi: qedi: Fix crash while reading debugfs attribute (bsc#1227929).
    - CVE-2022-48792: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task (bsc#1228013).
    - CVE-2022-48823: scsi: qedf: Fix refcount issue when LOGO is received during TMF (bsc#1228045).
    - CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()     (bsc#1227866).
    - CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
    - CVE-2024-40987: drm/amdgpu: fix UBSAN warning in kv_dpm.c (bsc#1228235)
    - CVE-2022-48826: drm/vc4: Fix deadlock on DSI device attach error (bsc#1227975)
    - CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
    - CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
    - CVE-2024-41016: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() (bsc#1228410).
    - CVE-2024-41063: bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580).
    - CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers     (bsc#1228470).
    - CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
    - CVE-2021-47405: HID: usbhid: free raw_report buffers in usbhid_stop (bsc#1225238).
    - CVE-2024-40988: drm/radeon: fix UBSAN warning in kv_dpm.c (bsc#1227957)
    - CVE-2024-40932: drm/exynos/vidi: fix memory leak in .get_modes() (bsc#1227828)
    - CVE-2021-47403: ipack: ipoctal: fix module reference leak (bsc#1225241).
    - CVE-2021-47388: mac80211: fix use-after-free in CCMP/GCMP RX (bsc#1225214).
    - CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
    - CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
    - CVE-2024-35837: net: mvpp2: clear BM pool before initialization (bsc#1224500).
    - CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
    - CVE-2022-48804: vt_ioctl: fix array_index_nospec in vt_setactivate (bsc#1227968).
    - CVE-2024-40967: serial: imx: Introduce timeout when waiting on transmitter empty (bsc#1227891).
    - CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
    - CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071).
    - CVE-2021-47582: usb: core: Do not hold the device lock while sleeping in do_proc_control()     (bsc#1226559).
    - CVE-2024-40982: ssb: fix potential NULL pointer dereference in ssb_device_uevent() (bsc#1227865).
    - CVE-2021-47468: isdn: mISDN: Fix sleeping function called from invalid context (bsc#1225346).
    - CVE-2021-47395: mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap (bsc#1225326).
    - CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path     (bsc#1227936).
    - CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).
    - CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
    - CVE-2021-47580: scsi: scsi_debug: Fix type in min_t to avoid stack OOB (bsc#1226550).
    - CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
    - CVE-2022-48811: ibmvnic: do not release napi in __ibmvnic_open() (bsc#1227928).
    - CVE-2021-0129: Improper access control in BlueZ may have allowed an authenticated user to potentially     enable information disclosure via adjacent access (bsc#1186463).
    - CVE-2020-26558: Fixed a flaw in the Bluetooth LE and BR/EDR secure pairing that could permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (bsc#1179610).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
    - CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
    - CVE-2024-40941: wifi: iwlwifi: mvm: do not read past the mfuart notifcation (bsc#1227771).
    - CVE-2022-48860: ethernet: Fix error handling in xemaclite_of_probe (bsc#1228008)
    - CVE-2022-48863: mISDN: Fix memory leak in dsp_pipeline_build() (bsc#1228063).
    - CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
    - CVE-2024-39499: vmci: prevent speculation leaks by sanitizing event in event_deliver() (bsc#1227725)
    - CVE-2024-39509: HID: core: remove unnecessary WARN_ON() in implement() (bsc#1227733)
    - CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
    - CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
    - CVE-2024-40959: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).
    - CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
    - CVE-2021-47441: mlxsw: thermal: Fix out-of-bounds memory accesses (bsc#1225224)
    - CVE-2021-47194: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (bsc#1222829)
    - CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
    - CVE-2022-48775: Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (bsc#1227924).
    - CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
    - CVE-2024-40929: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (bsc#1227774).
    - CVE-2024-40912: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (bsc#1227790).
    - CVE-2024-40942: wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects (bsc#1227770).
    - CVE-2022-48857: NFC: port100: fix use-after-free in port100_send_complete (bsc#1228005).
    - CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (bsc#1225719).
    - CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len. (bsc#1226555).
    - CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
    - CVE-2024-26924: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1225820).
    - CVE-2024-26830: Fixed i40e to not allow untrusted VF to remove administratively set MAC (bsc#1223012).
    - CVE-2021-47516: nfp: Fix memory leak in nfp_cpp_area_cache_add() (bsc#1225427).
    - CVE-2021-47501: i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc (bsc#1225361).
    - CVE-2024-39501: drivers: core: synchronize really_probe() and dev_uevent() (bsc#1227754).
    - CVE-2023-52743: ice: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1225003)
    - CVE-2021-47542: net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()     (bsc#1225455)
    - CVE-2024-36901: ipv6: prevent NULL dereference in ip6_output() (bsc#1225711)
    - CVE-2024-36004: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1224545)
    - CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
    - CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571).
    - CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
    - CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
    - CVE-2021-47597: inet_diag: fix kernel-infoleak for UDP sockets (bsc#1226553).
    - CVE-2024-39490: ipv6: sr: fix missing sk_buff release in seg6_input_core (bsc#1227626).
    - CVE-2024-38558: net: openvswitch: fix overwriting ct original tuple for ICMPv6 (bsc#1226783).
    - CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
    - CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram     (bsc#1221618).
    - CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).
    - CVE-2024-35978: Bluetooth: Fix memory leak in hci_req_sync_complete() (bsc#1224571).
    - CVE-2023-52669: crypto: s390/aes - Fix buffer overread in CTR mode (bsc#1224637).
    - CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).
    - CVE-2023-52612: Fixed req->dst buffer overflow in crypto/scomp (bsc#1221616).
    - CVE-2024-35995: ACPI: CPPC: Use access_width over bit_width for system memory accesses (bsc#1224557).
    - CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).
    - CVE-2021-47295: net: sched: fix memory leak in tcindex_partial_destroy_work (bsc#1224975)
    - CVE-2024-38630: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (bsc#1226908).
    - CVE-2021-47559: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() (bsc#1225396).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4617-1 advisory.

    The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
    - CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
    - CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
    - CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
    - CVE-2022-3633: Fixed a memory leak in j1939_session_destroy of the file net/can/j1939/transport.c     (bsc#1204650).
    - CVE-2022-3114: Fixed a denial of service in imx_register_uart_clocks() in drivers/clk/imx/clk.c     (bsc#1206391).
    - CVE-2022-3619: Fixed a memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c     (bsc#1204569).
    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect()     and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively)     remotely via Bluetooth (bsc#1205709).
    - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req()     which can be used to leak kernel pointers remotely (bsc#1205705).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-3545: Fixed a use-after-free vulnerability is area_cache_get() of the file     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
    - CVE-2022-3521: Fixed a race condition in kcm_tx_work() of the file net/kcm/kcmsock.c (bsc#1204355).
    - CVE-2022-2153: Fixed a NULL pointer dereference in KVM when attempting to set a SynIC IRQ (bsc#1200788).
    - CVE-2022-33981: Fixed a denial of service, because of a concurrency use-after-free flaw after     deallocating raw_cmd in the raw_cmd_ioctl function (bsc#1200692).
    - CVE-2022-45869: Fixed a race condition in the x86 KVM subsystem which could cause a denial of service     (bsc#1205882).
    - CVE-2022-45888: Fixed a use-after-free during physical removal of a USB devices when using     drivers/char/xillybus/xillyusb.c (bsc#1205764).
    - CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory     (bsc#1205700).
    - CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when     clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
    - CVE-2022-3566: Fixed a race condition in the functions tcp_getsockopt/tcp_setsockopt. The manipulation     leads to a race condition (bsc#1204405).
    - CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection     and io_uring (bsc#1204228).
    - CVE-2022-3176: Fixed a use-after-free in io_uring related to signalfd_poll() and binder_poll()     (bsc#1203391).
    - CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).
    - CVE-2022-3625: Fixed a user-after-free vulnerability in devlink_param_set/devlink_param_get of the file     net/core/devlink.c (bsc#1204637).
    - CVE-2022-3535: Fixed a memory leak in mvpp2_dbgfs_port_init of the file     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bsc#1204417).
    - CVE-2022-39189: Fixed an issue were an unprivileged guest users can compromise the guest kernel because     TLB flush operations were mishandled in certain KVM_VCPU_PREEMPTED situations (bsc#1203066).
    - CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c     (bsc#1204470).
    - CVE-2022-2978: Fixed a use-after-free in the NILFS file system (bsc#1202700).
    - CVE-2022-1184: Fixed a use-after-free and memory errors in ext4 when mounting and operating on a     corrupted image (bsc#1198577).
    - CVE-2022-1263: Fixed a NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty     ring support enabled. This flaw allowed an unprivileged local attacker on the host to issue specific ioctl     calls, causing a kernel oops condition that results in a denial of service (bsc#1198189).
    - CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or     potentially escalate their privileges on the system (bsc#1199904).
    - CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf     of v4l2-mem2mem.c (bsc#1202347).
    - CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-26373: Fixed CPU information leak via post-barrier RSB predictions (bsc#1201726).
    - CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size()     (bsc#1202154).
    - CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured (bsc#1202097).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-28356: Fixed a refcount bug in llc_ui_bind and llc_ui_autobind which could allow an     unprivileged user to execute a denial of service. (bsc#1197391)
    - CVE-2022-2873: Fixed an out-of-bounds memory access flaw that was found in iSMT SMBus host controller     driver (bsc#1202558).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202860).
    - CVE-2022-2938: Fixed a flaw that was found inside the Pressure Stall Information implementation that     could have been used to allow an attacker to crash the system or have other memory-corruption side effects     (bsc#1202623).
    - CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in     pipe_resize_ring() (bsc#1202681).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-3028: Fixed a race condition that was found in the IP framework for transforming packets (XFRM     subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously (bsc#1202898).
    - CVE-2022-3078: Fixed a lack of check after calling vzalloc() and lack of free after allocation in     drivers/media/test-drivers/vidtv/vidtv_s302m.c (bsc#1203041).
    - CVE-2022-3202: Fixed a NULL pointer dereference flaw in Journaled File System. This could allow a local     attacker to crash the system or leak kernel internal information (bsc#1203389).
    - CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege     escalation (bsc#1200015).
    - CVE-2022-32296: Fixed vulnerability where TCP servers were allowed to identify clients by observing what     source ports are used (bsc#1200288).
    - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to     crash the system or escalate their privileges (bsc#1203552).
    - CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bsc#1203769).
    - CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c     (bsc#1204171).
    - CVE-2022-3526: Fixed a memory leak in macvlan_handle_frame() from drivers/net/macvlan.c (bsc#1204353).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bsc#1204619).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bsc#1201948).
    - CVE-2022-36946: Fixed a denial of service inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c     (bsc#1201940).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bsc#1203107).
    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bsc#1203117).
    - CVE-2022-40476: Fixed a null pointer dereference in fs/io_uring.c (bsc#1203435).
    - CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c     (bsc#1202960).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a PCMCIA device while calling ioctl (bsc#1203987).
    - CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a USB device while calling open (bsc#1203992).
    - CVE-2022-42719: Fixed remote code execution with wlan frames when parsing a multi-BSSID element     (bsc#1204051).
    - CVE-2022-42720: Fixed remote code execution due to refcounting bugs (bsc#1204059).
    - CVE-2022-42721: Fixed remote code execution due list corruption in the wlan stack (bsc#1204060).
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
    - CVE-2021-33135: Fixed uncontrolled resource consumption inside Intel(R) SGX that may have allowed an     authenticated user to potentially enable denial of service via local access (bsc#1199515).
    - CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a     DCCP socket. (bsc#1177471)
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bsc#1196616).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bsc#1023051).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This     could lead to local escalation of privilege in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-222091980References: Upstream kernel (CVE-2022-20153)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - io_uring use work_flags to determine which identity need to grab from the calling process to make sure it     is consistent with the calling process when executing IORING_OP. Some operations are missing some types,     which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading     the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 (CVE-2022-2327)

  - The Linux kernel was found vulnerable out of bounds memory access in the     drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers     being able to crash the kernel. (CVE-2022-2380)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An out-of-bounds memory access flaw was found in the Linux kernel Intel's iSMT SMBus host controller     driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input     data. This flaw allows a local user to crash the system. (CVE-2022-2873)

  - A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679) (CVE-2022-2586)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This     could lead to local escalation of privilege in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-222091980References: Upstream kernel (CVE-2022-20153)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - io_uring use work_flags to determine which identity need to grab from the calling process to make sure it     is consistent with the calling process when executing IORING_OP. Some operations are missing some types,     which can lead to incorrect reference counts which can then lead to a double free. We recommend upgrading     the kernel past commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 (CVE-2022-2327)

  - The Linux kernel was found vulnerable out of bounds memory access in the     drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers     being able to crash the kernel. (CVE-2022-2380)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An out-of-bounds memory access flaw was found in the Linux kernel Intel's iSMT SMBus host controller     driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input     data. This flaw allows a local user to crash the system. (CVE-2022-2873)

  - A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out- of-bounds writes.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167218	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3897-1)	Nessus	SuSE Local Security Checks	2022/11/9	2025/9/25	high
167336	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:3930-1)	Nessus	SuSE Local Security Checks	2022/11/13	2025/9/30	high
167349	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3929-1)	Nessus	SuSE Local Security Checks	2022/11/13	2025/9/25	high
167939	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:4072-1)	Nessus	SuSE Local Security Checks	2022/11/19	2025/9/24	high
170855	RHEL 9 : kernel (RHSA-2023:0512)	Nessus	Red Hat Local Security Checks	2023/1/30	2025/8/15	high
170404	RHEL 9 : kernel (RHSA-2023:0334)	Nessus	Red Hat Local Security Checks	2023/1/23	2025/8/15	high
175818	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.5.3)	Nessus	Misc.	2023/5/16	2025/2/17	critical
205735	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2024:2940-1)	Nessus	SuSE Local Security Checks	2024/8/17	2025/10/9	high
169292	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:4617-1)	Nessus	SuSE Local Security Checks	2022/12/24	2025/9/25	high
166809	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2654)	Nessus	Huawei Local Security Checks	2022/11/2	2024/6/26	high
169391	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2022-2932)	Nessus	Huawei Local Security Checks	2022/12/28	2024/6/26	high
503242	ABB M2M Gateway Arbitrary Code Execution in embedded Linux Kernel (CVE-2022-2964)	Tenable OT Security	Tenable.ot	2025/5/27	2025/5/27	high

检测

插件搜索

high

high

high

high

high

high

critical

high

high

high

high

high