The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5249 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-1966)

    * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * make SHA512_arch algos and CRYPTO_USER built-ins (BZ#2072643)

    * SR-IOV performance > 50% degradation (BZ#2074830)

    * fix data corruption caused by dm-integrity (BZ#2082187)

    * SCTP client-side peeloff issues [rhel-9] (BZ#2084044)

    * TCP connection fails in a asymmetric routing situation (BZ#2085480)

    * Fails to boot Multiple RT VMs each with multiple vCPUs (BZ#2086963)

    * spec: Fix separate tools build (BZ#2090852)

    * call traces related to eeh_pseries observed and vmcore is not captured, when kdump is triggered     (BZ#2092255)

    * Mark ThunderX NIC driver as unmaintained (BZ#2092638)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2239-1 advisory.

  - Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause     memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to     5.4.189; version 5.4.24 and later versions. (CVE-2022-1116)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5173 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2021-4197 Eric Biederman reported that incorrect permission     checks in the cgroup process migration implementation can allow a local attacker to escalate privileges.
    CVE-2022-0494 The scsi_ioctl() was susceptible to an information leak only exploitable by users with     CAP_SYS_ADMIN or CAP_SYS_RAWIO capabilities. CVE-2022-0812 It was discovered that the RDMA transport for     NFS (xprtrdma) miscalculated the size of message headers, which could lead to a leak of sensitive     information between NFS servers and clients. CVE-2022-0854 Ali Haider discovered a potential information     leak in the DMA subsystem. On systems where the swiotlb feature is needed, this might allow a local user     to read sensitive information. CVE-2022-1011 Jann Horn discovered a flaw in the FUSE (Filesystem in User-     Space) implementation. A local user permitted to mount FUSE filesystems could exploit this to cause a use-     after-free and read sensitive information. CVE-2022-1012, CVE-2022-32296 Moshe Kol, Amit Klein, and Yossi     Gilad discovered a weakness in randomisation of TCP source port selection. CVE-2022-1016 David Bouman     discovered a flaw in the netfilter subsystem where the nft_do_chain function did not initialize register     data that nf_tables expressions can read from and write to. A local attacker can take advantage of this to     read sensitive information. CVE-2022-1048 Hu Jiahui discovered a race condition in the sound subsystem     that can result in a use-after-free. A local user permitted to access a PCM sound device can take     advantage of this flaw to crash the system or potentially for privilege escalation. CVE-2022-1184 A flaw     was discovered in the ext4 filesystem driver which can lead to a use-after-free. A local user permitted to     mount arbitrary filesystems could exploit this to cause a denial of service (crash or memory corruption)     or possibly for privilege escalation. CVE-2022-1195 Lin Ma discovered race conditions in the 6pack and     mkiss hamradio drivers, which could lead to a use-after-free. A local user could exploit these to cause a     denial of service (memory corruption or crash) or possibly for privilege escalation. CVE-2022-1198 Duoming     Zhou discovered a race condition in the 6pack hamradio driver, which could lead to a use-after-free. A     local user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2022-1199, CVE-2022-1204, CVE-2022-1205 Duoming Zhou discovered race conditions     in the AX.25 hamradio protocol, which could lead to a use-after-free or null pointer dereference. A local     user could exploit this to cause a denial of service (memory corruption or crash) or possibly for     privilege escalation. CVE-2022-1353 The TCS Robot tool found an information leak in the PF_KEY subsystem.
    A local user can receive a netlink message when an IPsec daemon registers with the kernel, and this could     include sensitive information. CVE-2022-1419 Minh Yuan discovered a race condition in the vgem virtual GPU     driver that can lead to a use-after-free. A local user permitted to access the GPU device can exploit this     to cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2022-1516 A NULL pointer dereference flaw in the implementation of the X.25 set of standardized     network protocols, which can result in denial of service. This driver is not enabled in Debian's official     kernel configurations. CVE-2022-1652 Minh Yuan discovered a race condition in the floppy driver that can     lead to a use-after-free. A local user permitted to access a floppy drive device can exploit this to cause     a denial of service (crash or memory corruption) or possibly for privilege escalation. CVE-2022-1729     Norbert Slusarek discovered a race condition in the perf subsystem which could result in local privilege     escalation to root. The default settings in Debian prevent exploitation unless more permissive settings     have been applied in the kernel.perf_event_paranoid sysctl. CVE-2022-1734 Duoming Zhou discovered race     conditions in the nfcmrvl NFC driver that could lead to a use-after-free, double-free or null pointer     dereference. A local user might be able to exploit these for denial of service (crash or memory     corruption) or possibly for privilege escalation. This driver is not enabled in Debian's official kernel     configurations. CVE-2022-1974, CVE-2022-1975 Duoming Zhou discovered that the NFC netlink interface was     suspectible to denial of service. CVE-2022-2153 kangel reported a flaw in the KVM implementation for x86     processors which could lead to a null pointer dereference. A local user permitted to access /dev/kvm could     exploit this to cause a denial of service (crash). CVE-2022-21123, CVE-2022-21125, CVE-2022-21166 Various     researchers discovered flaws in Intel x86 processors, collectively referred to as MMIO Stale Data     vulnerabilities. These are similar to the previously published Microarchitectural Data Sampling (MDS)     issues and could be exploited by local users to leak sensitive information. For some CPUs, the mitigations     for these issues require updated microcode. An updated intel-microcode package may be provided at a later     date. The updated CPU microcode may also be available as part of a system firmware (BIOS) update.
    Further information on the mitigation can be found at https://www.kernel.org/doc/html/latest/admin-     guide/hw-vuln/processor_mmio_stale_data.html or in the linux-doc-4.19 package. CVE-2022-23960 Researchers     at VUSec discovered that the Branch History Buffer in Arm processors can be exploited to create     information side channels with speculative execution. This issue is similar to Spectre variant 2, but     requires additional mitigations on some processors. This was previously mitigated for 32-bit Arm (armel     and armhf) architectures and is now also mitigated for 64-bit Arm (arm64). This can be exploited to obtain     sensitive information from a different security context, such as from user-space to the kernel, or from a     KVM guest to the kernel. CVE-2022-26490 Buffer overflows in the STMicroelectronics ST21NFCA core driver     can result in denial of service or privilege escalation. This driver is not enabled in Debian's official     kernel configurations. CVE-2022-27666 valis reported a possible buffer overflow in the IPsec ESP     transformation code. A local user can take advantage of this flaw to cause a denial of service or for     privilege escalation. CVE-2022-28356 Beraphin discovered that the ANSI/IEEE 802.2 LLC type 2 driver did     not properly perform reference counting on some error paths. A local attacker can take advantage of this     flaw to cause a denial of service. CVE-2022-28388 A double free vulnerability was discovered in the 8     devices USB2CAN interface driver. CVE-2022-28389 A double free vulnerability was discovered in the     Microchip CAN BUS Analyzer interface driver. CVE-2022-28390 A double free vulnerability was discovered in     the EMS CPC-USB/ARM7 CAN/USB interface driver. CVE-2022-29581 Kyle Zeng discovered a reference-counting     bug in the cls_u32 network classifier which can lead to a use-after-free. A local user can exploit this to     cause a denial of service (crash or memory corruption) or possibly for privilege escalation.
    CVE-2022-30594 Jann Horn discovered a flaw in the interaction between ptrace and seccomp subsystems. A     process sandboxed using seccomp() but still permitted to use ptrace() could exploit this to remove the     seccomp restrictions. CVE-2022-32250 Aaron Adams discovered a use-after-free in Netfilter which may result     in local privilege escalation to root. CVE-2022-33981 Yuan Ming from Tsinghua University reported a race     condition in the floppy driver involving use of the FDRAWCMD ioctl, which could lead to a use-after-free.
    A local user with access to a floppy drive device could exploit this to cause a denial of service (crash     or memory corruption) or possibly for privilege escalation. This ioctl is now disabled by default. For the     oldstable distribution (buster), these problems have been fixed in version 4.19.249-2. Due to an issue in     the signing service (Cf. Debian bug #1012741), the vport-vxlan module cannot be loaded for the signed     kernel for amd64 in this update. This update also corrects a regression in the network scheduler subsystem     (bug #1013299). For the 32-bit Arm (armel and armhf) architectures, this update enables optimised     implementations of several cryptographic and CRC algorithms. For at least AES, this should remove a timing     sidechannel that could lead to a leak of sensitive information. This update includes many more bug fixes     from stable updates 4.19.236-4.19.249 inclusive, including for bug #1006346. The random driver has been     backported from Linux 5.19, fixing numerous performance and correctness issues. Some changes will be     visible: The entropy pool size is now 256 bits instead of 4096. You may need to adjust the configuration     of system monitoring or user-space entropy gathering services to allow for this. On systems without a     hardware RNG, the kernel may log more uses of /dev/urandom before it is fully initialised. These uses were     previously under-counted and this is not a regression. We recommend that you upgrade your linux packages.
    For the detailed security status of linux please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5626 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    * kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

    * kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

    * kernel: the copy-on-write implementation can grant unintended write access because of a race condition     in a THP mapcount check (CVE-2020-29368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Failed to reboot after crash trigger (BZ#2060747)

    * conntrack entries linger around after test (BZ#2066357)

    * Enable nested virtualization (BZ#2079070)

    * slub corruption during  LPM of hnv interface (BZ#2081251)

    * sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35 (BZ#2082091)

    * Backport request of genirq: use rcu in kstat_irqs_usr() (BZ#2083309)

    * ethtool -L may cause system to hang (BZ#2083323)

    * For isolated CPUs (with nohz_full enabled for isolated CPUs) CPU utilization statistics are not getting     reflected continuously (BZ#2084139)

    * Affinity broken due to vector space exhaustion (BZ#2084647)

    * kernel memory leak while freeing nested actions (BZ#2086597)

    * sync rhel-8.6 with upstream 5.13 through 5.16 fixes and improvements (BZ#2088037)

    * Kernel panic possibly when cleaning namespace on pod deletion (BZ#2089539)

    * Softirq hrtimers are being placed on the per-CPU softirq clocks on isolcpus. (BZ#2090485)

    * fix missed wake-ups in rq_qos_throttle try two (BZ#2092076)

    * NFS4 client experiencing IO outages while sending duplicate SYNs and erroneous RSTs during connection     reestablishment (BZ#2094334)

    * using __this_cpu_read() in preemptible [00000000] code: kworker/u66:1/937154 (BZ#2095775)

    * Need some changes in RHEL8.x kernels. (BZ#2096932)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5641 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.126-117.518. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-017 advisory.

    Due to the small table perturb size, a memory leak flaw was found in the Linux kernel's TCP source port     generation algorithm in the net/ipv4/tcp.c function. This flaw allows an attacker to leak information and     may cause a denial of service. (CVE-2022-1012)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg     callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause     a kernel oops condition on the host, resulting in a denial of service. (CVE-2022-1789)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    No description is available for this CVE. (CVE-2022-1972)

    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

    KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and     Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). (CVE-2022-21499)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5839 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2741-1 advisory.

  - A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of     ttys could lead to a use-after-free. (CVE-2020-36557)

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause     memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to     5.4.189; version 5.4.24 and later versions. (CVE-2022-1116)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505) (CVE-2022-21505)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - In several functions of binder.c, there is a possible way to represent the wrong domain to SELinux due to     a race condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-200688826References: Upstream kernel (CVE-2021-39686)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP     pacing can lead to memory/netns leak, which can be used by remote clients. (CVE-2022-1678)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 ('Double-Hash Port Selection Algorithm') of RFC 6056.
    (CVE-2022-32296)

  - Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree     to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the     related lock held, resulting in a small race window, which can be used by unprivileged guests via PV     devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS)     of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory     pages. (CVE-2022-33744)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0146 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-32250:
    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.63 / 5.15.63_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-237-02 advisory.

    New kernel packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the kernel-generic security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
162652	RHEL 9 : kernel (RHSA-2022:5249)	Nessus	Red Hat Local Security Checks	2022/7/1	2025/9/12	high
162692	SUSE SLES15 Security Update : kernel (Live Patch 10 for SLE 15 SP3) (SUSE-SU-2022:2239-1)	Nessus	SuSE Local Security Checks	2022/7/2	2024/1/16	high
162703	Debian DSA-5173-1 : linux - security update	Nessus	Debian Local Security Checks	2022/7/4	2025/1/24	high
163291	RHEL 8 : kernel (RHSA-2022:5626)	Nessus	Red Hat Local Security Checks	2022/7/20	2025/8/18	high
163296	RHEL 8 : kpatch-patch (RHSA-2022:5641)	Nessus	Red Hat Local Security Checks	2022/7/20	2024/11/7	high
163368	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-017)	Nessus	Amazon Linux Local Security Checks	2022/7/21	2026/1/26	high
163794	RHEL 8 : kpatch-patch (RHSA-2022:5839)	Nessus	Red Hat Local Security Checks	2022/8/3	2025/3/6	high
164061	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2741-1)	Nessus	SuSE Local Security Checks	2022/8/11	2023/7/14	high
169319	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2022-2873)	Nessus	Huawei Local Security Checks	2022/12/27	2024/1/16	high
203749	Photon OS 3.0: Linux PHSA-2022-3.0-0409	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/21	high
224771	Linux Distros Unpatched Vulnerability : CVE-2022-32250	Nessus	Misc.	2025/3/5	2025/10/28	high
236623	Alibaba Cloud Linux 3 : 0146: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2022:0146)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
164458	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2022-237-02)	Nessus	Slackware Local Security Checks	2022/8/26	2025/10/29	high
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2026/2/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high