The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6149-1 advisory.

    Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the     Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-32233)

    Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-31436)

    Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did     not properly validate control registers in certain situations. An attacker in a guest VM could use this to     cause a denial of service (guest crash). (CVE-2023-30456)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     data buffer size validation in some situations. A physically proximate attacker could use this to craft a     malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose     sensitive information. (CVE-2023-1380)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    Wei Chen discovered that the DVB USB AZ6027 driver in the Linux kernel contained a null pointer     dereference when handling certain messages from user space. A local attacker could use this to cause a     denial of service (system crash). (CVE-2023-28328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6150-1 advisory.

    Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the     Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-32233)

    Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-31436)

    Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did     not properly validate control registers in certain situations. An attacker in a guest VM could use this to     cause a denial of service (guest crash). (CVE-2023-30456)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     data buffer size validation in some situations. A physically proximate attacker could use this to craft a     malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose     sensitive information. (CVE-2023-1380)

    Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race     condition when handling inode locking in some situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2023-2612)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6162-1 advisory.

    Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the     Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-32233)

    Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-31436)

    Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did     not properly validate control registers in certain situations. An attacker in a guest VM could use this to     cause a denial of service (guest crash). (CVE-2023-30456)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     data buffer size validation in some situations. A physically proximate attacker could use this to craft a     malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose     sensitive information. (CVE-2023-1380)

    Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race     condition when handling inode locking in some situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2023-2612)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege.(CVE-2023-2176)

    An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace 'data-block[0]' variable was not capped to a number between 0-255 and was used as the size of     a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution.(CVE-2023-2194)

    An out-of-bounds memory access flaw was found in the Linux kernels traffic control (QoS) subsystem in     how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used     as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the     system.(CVE-2023-2248)

    A race condition vulnerability was found in the Linux kernel's Qualcomm EMAC Gigabit Ethernet Controller     when the user physically removes the device before cleanup in the emac_remove function. This flaw can     eventually result in a use-after-free issue, possibly leading to a system crash or other undefined     behaviors.(CVE-2023-2483)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions.(CVE-2022-29901)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6256-1 advisory.

    Jiasheng Jiang discovered that the HSA Linux kernel driver for AMD Radeon GPU devices did not properly     validate memory allocation in certain situations, leading to a null pointer dereference vulnerability. A     local attacker could use this to cause a denial of service (system crash). (CVE-2022-3108)

    Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle     certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-3707)

    It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A     local attacker with physical access could plug in a specially crafted USB device to cause a denial of     service (memory exhaustion). (CVE-2022-3903)

    Haowei Yan discovered that a race condition existed in the Layer 2 Tunneling Protocol (L2TP)     implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-4129)

    Jordy Zomer and Alexandra Sandulescu discovered that syscalls invoking the do_prlimit() function in the     Linux kernel did not properly handle speculative execution barriers. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2023-0458)

    Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement     speculative execution barriers in usercopy functions in certain situations. A local attacker could use     this to expose sensitive information (kernel memory). (CVE-2023-0459)

    It was discovered that the Human Interface Device (HID) support driver in the Linux kernel contained a     type confusion vulnerability in some situations. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-1073)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    It was discovered that the TLS subsystem in the Linux kernel contained a type confusion vulnerability in     some situations. A local attacker could use this to cause a denial of service (system crash) or possibly     expose sensitive information. (CVE-2023-1075)

    It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A     local attacker could use this to cause a denial of service (system crash). (CVE-2023-1076)

    It was discovered that the Real-Time Scheduling Class implementation in the Linux kernel contained a type     confusion vulnerability in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-1077)

    It was discovered that the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel     contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial     of service (system crash). (CVE-2023-1078)

    It was discovered that the ASUS HID driver in the Linux kernel did not properly handle device removal,     leading to a use-after-free vulnerability. A local attacker with physical access could plug in a specially     crafted USB device to cause a denial of service (system crash). (CVE-2023-1079)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel contained a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2023-1281)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     data buffer size validation in some situations. A physically proximate attacker could use this to craft a     malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose     sensitive information. (CVE-2023-1380)

    Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel did not properly initialize     some data structures. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2023-1513)

    It was discovered that the Xircom PCMCIA network device driver in the Linux kernel did not properly handle     device removal events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2023-1670)

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel did not     properly perform filter deactivation in some situations. A local attacker could possibly use this to gain     elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier     has been removed. (CVE-2023-1829)

    It was discovered that a race condition existed in the Xen transport layer implementation for the 9P file     system protocol in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (guest crash) or expose sensitive information (guest kernel memory).
    (CVE-2023-1859)

    Jose Oliveira and Rodrigo Branco discovered that the Spectre Variant 2 mitigations with prctl syscall were     insufficient in some situations. A local attacker could possibly use this to expose sensitive information.
    (CVE-2023-1998)

    It was discovered that a use-after-free vulnerability existed in the iSCSI TCP implementation in the Linux     kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2162)

    It was discovered that the BigBen Interactive Kids' gamepad driver in the Linux kernel did not properly     handle device removal, leading to a use- after-free vulnerability. A local attacker with physical access     could plug in a specially crafted USB device to cause a denial of service (system crash). (CVE-2023-25012)

    Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race     condition when handling inode locking in some situations. A local attacker could use this to cause a     denial of service (kernel deadlock). (CVE-2023-2612)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that a use-after-free vulnerability existed in the HFS+ file system implementation in     the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2023-2985)

    Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did     not properly validate control registers in certain situations. An attacker in a guest VM could use this to     cause a denial of service (guest crash). (CVE-2023-30456)

    Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel     contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-31436)

    Sanan Hasanov discovered that the framebuffer console driver in the Linux kernel did not properly perform     checks for font dimension limits. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-3161)

    Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the     Linux kernel when processing batch requests, leading to a use-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-32233)

    It was discovered that the NET/ROM protocol implementation in the Linux kernel contained a race condition     in some situations, leading to a use- after-free vulnerability. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32269)

    Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-     bounds write vulnerability. An attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-35788, LP: #2023577)

    It was discovered that for some Intel processors the INVLPG instruction implementation did not properly     flush global TLB entries when PCIDs are enabled. An attacker could use this to expose sensitive     information (kernel memory) or possibly cause undesired behaviors. (LP: #2023220)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in     drivers/media/pci/dm1105/dm1105.c.(CVE-2023-35824)

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c.(CVE-2023-35823)

    CVE-2023-3327 kernel: saa7134: race condition leading to use-after-free in     saa7134_finidev()(CVE-2023-3327)

    An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation.(CVE-2023-35788)

    An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information.(CVE-2023-3268)

    A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux     Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when     queue_event() fails.(CVE-2023-3159)

    A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak.(CVE-2023-3141)

    A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font-width and     font-height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-     bounds occurs leading to undefined behavior and possible denial of service.(CVE-2023-3161)

    ** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in     crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check     an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against     attackers with the stated 'When modifying the block device while it is mounted by the filesystem'     access.(CVE-2023-34256)

    A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness,     potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field     that overlaps with rec-tx_ready.(CVE-2023-1075)

    An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the     packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables     rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
    NOTE: cc00bca was reverted in 5.12.(CVE-2020-36694)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(fepriv-sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(fepriv-sem) may block the process.(CVE-2023-31084)

    ** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it was the     duplicate of CVE-2023-31436.(CVE-2023-2248)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond     commit74e19ef0ff8061ef55957c3abd71614ef0f42f47(CVE-2023-0459)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication.(CVE-2023-2002)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based     device.(CVE-2023-33203)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors.(CVE-2023-2513)

    A race condition vulnerability was found in the Linux kernel's Qualcomm EMAC Gigabit Ethernet Controller     when the user physically removes the device before cleanup in the emac_remove function. This flaw can     eventually result in a use-after-free issue, possibly leading to a system crash or other undefined     behaviors.(CVE-2023-2483)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    An out-of-bounds memory access flaw was found in the Linux kernels traffic control (QoS) subsystem in     how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used     as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the     system.(CVE-2023-2248)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond     commit74e19ef0ff8061ef55957c3abd71614ef0f42f47(CVE-2023-0459)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

    A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege.(CVE-2023-2176)

    An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace 'data-block[0]' variable was not capped to a number between 0-255 and was used as the size of     a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution.(CVE-2023-2194)

    The Linux kernel allows userspace processes to enable mitigations by calling prctl with     PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed     that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to     attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be     observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened     because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that     STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
    However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons,     which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target     injection against which STIBP protects.(CVE-2023-1998)

    A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault     handler. The issue results from the lack of proper validation of user-supplied data, which can result in a     memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges     and execute arbitrary code in the context of the kernel.(CVE-2023-2008)

    A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation. The io_file_get_fixed function lacks the presence of ctx-uring_lock which can     lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We     recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.(CVE-2023-1872)

    A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue.(CVE-2022-1015)

    An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS).(CVE-2022-36280)

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4.(CVE-2023-30456)

    A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem.(CVE-2023-1838)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks.(CVE-2023-1637)

    A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak.(CVE-2023-1513)

    A double-free flaw was found in the Linux kernels TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system.(CVE-2022-4744)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation.The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.A local attacker user can use     this vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.(CVE-2023-1281)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference).(CVE-2023-28466)

    A use-after-free flaw was found in the Linux kernels core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 ('coredump: Use the vma snapshot in fill_files_note') not     applied yet, then kernel could be affected.(CVE-2023-1249)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in     drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based     device.(CVE-2023-33203)

    In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled.(CVE-2023-32233)

    A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors.(CVE-2023-2513)

    ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a     reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage.(CVE-2023-2483)

    A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The     resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be     used to leak the contents. We recommend upgrading past version 6.1.8 or     commit739790605705ddcf18f21782b9c99ad7d53a8c11(CVE-2023-0458)

    An out-of-bounds memory access flaw was found in the Linux kernels traffic control (QoS) subsystem in     how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used     as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the     system.(CVE-2023-2248)

    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.(CVE-2023-31436)

    A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal     information.(CVE-2023-2162)

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the 'access_ok' check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond     commit74e19ef0ff8061ef55957c3abd71614ef0f42f47(CVE-2023-0459)

    A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in     Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A     local user could use this flaw to crash the system or potentially cause a denial of     service.(CVE-2023-2177)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.(CVE-2023-2269)

    An out-of-bounds memory access flaw was found in the Linux kernels XFS file system in how a user     restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system.(CVE-2023-2124)

    A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege.(CVE-2023-2176)

    An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The     userspace 'data-block[0]' variable was not capped to a number between 0-255 and was used as the size of     a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to     crash the system or potentially achieve code execution.(CVE-2023-2194)

    The Linux kernel allows userspace processes to enable mitigations by calling prctl with     PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed     that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to     attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be     observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened     because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that     STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
    However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons,     which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target     injection against which STIBP protects.(CVE-2023-1998)

    A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault     handler. The issue results from the lack of proper validation of user-supplied data, which can result in a     memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges     and execute arbitrary code in the context of the kernel.(CVE-2023-2008)

    A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local     privilege escalation. The io_file_get_fixed function lacks the presence of ctx-uring_lock which can     lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We     recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.(CVE-2023-1872)

    A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue.(CVE-2022-1015)

    An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in     drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128     (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing     a denial of service(DoS).(CVE-2022-36280)

    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4.(CVE-2023-30456)

    A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem.(CVE-2023-1838)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks.(CVE-2023-1637)

    A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak.(CVE-2023-1513)

    A double-free flaw was found in the Linux kernels TUN/TAP device driver functionality in how a user     registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw     allows a local user to crash or potentially escalate their privileges on the system.(CVE-2022-4744)

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation.The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.A local attacker user can use     this vulnerability to elevate its privileges to root.This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.(CVE-2023-1281)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference).(CVE-2023-28466)

    A use-after-free flaw was found in the Linux kernels core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 ('coredump: Use the vma snapshot in fill_files_note') not     applied yet, then kernel could be affected.(CVE-2023-1249)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0340 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2020-27820:
    A vulnerability was found in Linux kernel, where a use-after-frees in nouveau/'s postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver).

    CVE-2021-0920:
    In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel

    CVE-2021-20321:
    A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.

    CVE-2021-22543:
    An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation.

    CVE-2021-38160:
    ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.

    CVE-2021-38199:
    fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which     allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for     those servers to be unreachable during trunking detection.

    CVE-2021-45868:
    In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file.

    CVE-2022-0617:
    A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.

    CVE-2022-0850:
    A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace.

    CVE-2022-20421:
    In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free.
    This could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-239630375References: Upstream kernel

    CVE-2022-2196:
    A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution     attacks.L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or     IBPBafter running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code     execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2     or past commit2e7eab81425a


    CVE-2022-2639:
    An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system.

    CVE-2022-29581:
    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions.

    CVE-2022-3567:
    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability.

    CVE-2022-3586:
    A flaw was found in the Linux kernels networking code. A use-after-free was found in the way the     sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and     freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a     denial of service.

    CVE-2022-4129:
    A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing     sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw     to potentially crash the system causing a denial of service.

    CVE-2022-41858:
    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information.

    CVE-2022-4378:
    A stack overflow flaw was found in the Linux kernel/'s SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system.

    CVE-2023-0045:
    The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The     ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL     MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the     TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to     the prctl syscall. The patch that added the support for the conditional mitigation via prctl     (ib_prctl_set) dates back to the kernel 4.9.176.

    We recommend upgrading past commita664ec9158eeddd75121d39c9a0758016097fa96

    CVE-2023-0394:
    A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash.

    CVE-2023-20938:
    In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input     validation. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid     ID: A-257685302References: Upstream kernel

    CVE-2023-2513:
    A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors.

    CVE-2023-30456:
    An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4.

    CVE-2023-31436:
    qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX.

    CVE-2023-32269:
    An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-     after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order     for an attacker to exploit this, the system must have netrom routing configured or the attacker must have     the CAP_NET_ADMIN capability.

    CVE-2023-35001:
    Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace

    CVE-2023-4128:
    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.

    CVE-2022-0847:
    A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system.

    CVE-2023-2269:
    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2809-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2020-24588: Fixed a bug that could allow an adversary to abuse devices that support receiving non-     SSP A-MSDU frames to inject arbitrary network packets (bsc#1185861).
    - CVE-2022-2196: Fixed a regression related to KVM that allowed for speculative execution attacks     (bsc#1206992).
    - CVE-2022-3523: Fixed a use after free related to device private page handling (bsc#1204363).
    - CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver (bsc#1203332).
    - CVE-2022-38096: Fixed NULL-ptr deref in vmw_cmd_dx_define_query() (bsc#1203331).
    - CVE-2022-4269: Fixed a flaw was found inside the Traffic Control (TC) subsystem (bsc#1206024).
    - CVE-2022-45884: Fixed a use-after-free in dvbdev.c, related to dvb_register_device dynamically     allocating fops (bsc#1205756).
    - CVE-2022-45885: Fixed a race condition in dvb_frontend.c that could cause a use-after-free when a device     is disconnected (bsc#1205758).
    - CVE-2022-45886: Fixed a .disconnect versus dvb_device_open race condition in dvb_net.c that lead to a     use-after-free (bsc#1205760).
    - CVE-2022-45887: Fixed a memory leak in ttusb_dec.c caused by the lack of a dvb_frontend_detach call     (bsc#1205762).
    - CVE-2022-45919: Fixed a use-after-free in dvb_ca_en50221.c that could occur if there is a disconnect     after an open, because of the lack of a wait_event (bsc#1205803).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2023-0045: Fixed missing Flush IBP in ib_prctl_set (bsc#1207773).
    - CVE-2023-0122: Fixed a NULL pointer dereference vulnerability in nvmet_setup_auth(), that allowed an     attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine (bsc#1207050).
    - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits (bsc#1207034).
    - CVE-2023-0386: A flaw was found where unauthorized access to the execution of the setuid file with     capabilities was found in the OverlayFS subsystem, when a user copies a capable file from a nosuid mount     into another mount. This uid mapping bug allowed a local user to escalate their privileges on the system     (bsc#1209615).
    - CVE-2023-0394: Fixed a null pointer dereference in the network subcomponent. This flaw could cause     system crashes (bsc#1207168).
    - CVE-2023-0461: Fixed use-after-free in icsk_ulp_data (bsc#1208787).
    - CVE-2023-0469: Fixed a use-after-free flaw in io_uring/filetable.c in io_install_fixed_file in the     io_uring subcomponent (bsc#1207521).
    - CVE-2023-0590: Fixed race condition in qdisc_graft() (bsc#1207795).
    - CVE-2023-0597: Fixed lack of randomization of per-cpu entry area in x86/mm (bsc#1207845).
    - CVE-2023-1075: Fixed a type confusion in tls_is_tx_ready (bsc#1208598).
    - CVE-2023-1076: Fixed incorrect UID assigned to tun/tap sockets (bsc#1208599).
    - CVE-2023-1077: Fixed a type confusion in pick_next_rt_entity(), that could cause memory corruption     (bsc#1208600).
    - CVE-2023-1078: Fixed a heap out-of-bounds write in rds_rm_zerocopy_callback (bsc#1208601).
    - CVE-2023-1079: Fixed a use-after-free problem that could have been triggered in asus_kbd_backlight_set     when plugging/disconnecting a malicious USB device (bsc#1208604).
    - CVE-2023-1095: Fixed a NULL pointer dereference in nf_tables due to zeroed list head (bsc#1208777).
    - CVE-2023-1118: Fixed a use-after-free bugs caused by ene_tx_irqsim() in media/rc (bsc#1208837).
    - CVE-2023-1249: Fixed a use-after-free flaw in the core dump subsystem that allowed a local user to crash     the system (bsc#1209039).
    - CVE-2023-1382: Fixed denial of service in tipc_conn_close (bsc#1209288).
    - CVE-2023-1513: Fixed an uninitialized portions of the kvm_debugregs structure that could be copied to     userspace, causing an information leak (bsc#1209532).
    - CVE-2023-1582: Fixed soft lockup in __page_mapcount (bsc#1209636).
    - CVE-2023-1583: Fixed a NULL pointer dereference in io_file_bitmap_get in io_uring/filetable.c     (bsc#1209637).
    - CVE-2023-1611: Fixed an use-after-free flaw in btrfs_search_slot (bsc#1209687).
    - CVE-2023-1637: Fixed vulnerability that could lead to unauthorized access to CPU memory after resuming     CPU from suspend-to-RAM (bsc#1209779, bsc#1198400).
    - CVE-2023-1652: Fixed use-after-free that could lead to DoS and information leak in nfsd4_ssc_setup_dul     in fs/nfsd/nfs4proc.c (bsc#1209788).
    - CVE-2023-1670: Fixed a use after free in the Xircom 16-bit PCMCIA Ethernet driver. A local user could     use this flaw to crash the system or potentially escalate their privileges on the system (bsc#1209871).
    - CVE-2023-1838: Fixed an use-after-free flaw in virtio network subcomponent. This flaw could allow a     local attacker to crash the system and lead to a kernel information leak problem. (bsc#1210203).
    - CVE-2023-1855: Fixed a use after free in xgene_hwmon_remove (bsc#1210202).
    - CVE-2023-1989: Fixed a use after free in btsdio_remove (bsc#1210336).
    - CVE-2023-1998: Fixed a use after free during login when accessing the shost ipaddress (bsc#1210506).
    - CVE-2023-2002: Fixed a flaw that allowed an attacker to unauthorized execution of management commands,     compromising the confidentiality, integrity, and availability of Bluetooth communication (bsc#1210533).
    - CVE-2023-21102: Fixed possible bypass of shadow stack protection in __efi_rt_asm_wrapper of efi-rt-     wrapper.S (bsc#1212155).
    - CVE-2023-21106: Fixed possible memory corruption due to double free in adreno_set_param of adreno_gpu.c     (bsc#1211654).
    - CVE-2023-2124: Fixed an out-of-bound access in the XFS subsystem that could have lead to denial-of-     service or potentially privilege escalation (bsc#1210498).
    - CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol     (bsc#1211131).
    - CVE-2023-2162: Fixed an use-after-free flaw in iscsi_sw_tcp_session_create (bsc#1210647).
    - CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c     in RDMA (bsc#1210629).
    - CVE-2023-2235: Fixed a use-after-free vulnerability in the Performance Events system that could have     been exploited to achieve local privilege escalation (bsc#1210986).
    - CVE-2023-2269: Fixed a denial-of-service problem due to a possible recursive locking scenario, resulting     in a deadlock in table_clear in drivers/md/dm-ioctl.c (bsc#1210806).
    - CVE-2023-22998: Fixed NULL vs IS_ERR checking in virtio_gpu_object_shmem_init (bsc#1208776).
    - CVE-2023-23000: Fixed return value of tegra_xusb_find_port_node function phy/tegra (bsc#1208816).
    - CVE-2023-23001: Fixed misinterpretation of regulator_get return value in drivers/scsi/ufs/ufs-mediatek.c     (bsc#1208829).
    - CVE-2023-23004: Fixed misinterpretation of get_sg_table return value (bsc#1208843).
    - CVE-2023-23006: Fixed NULL vs IS_ERR checking in dr_domain_init_resources (bsc#1208845).
    - CVE-2023-23454: Fixed a type confusion bug in the CBQ network scheduler which could lead to a use-after-     free (bsc#1207036).
    - CVE-2023-23455: Fixed a denial of service inside atm_tc_enqueue in net/sched/sch_atm.c because of type     confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid     classification results) (bsc#1207125).
    - CVE-2023-2483: Fixed a use after free bug in emac_remove caused by a race condition (bsc#1211037).
    - CVE-2023-25012: Fixed a use-after-free in bigben_set_led() (bsc#1207560).
    - CVE-2023-2513: Fixed a use-after-free vulnerability in the ext4 filesystem (bsc#1211105).
    - CVE-2023-26545: Fixed double free in net/mpls/af_mpls.c upon an allocation failure (bsc#1208700).
    - CVE-2023-28327: Fixed DoS in in_skb in unix_diag_get_exact() (bsc#1209290).
    - CVE-2023-28410: Fixed improper restriction of operations within the bounds of a memory buffer in some     Intel(R) i915 Graphics drivers that may have allowed an authenticated user to potentially enable     escalation of privilege via local access (bsc#1211263).
    - CVE-2023-28464: Fixed user-after-free that could lead to privilege escalation in hci_conn_cleanup in     net/uetooth/hci_conn.c (bsc#1209052).
    - CVE-2023-28866: Fixed an out-of-bounds access in net/bluetooth/hci_sync.c because amp_init1[] and     amp_init2[] are supposed to have an intentionally invalid element, but did not (bsc#1209780).
    - CVE-2023-3006: Fixed a known cache speculation vulnerability, known as Branch History Injection (BHI) or     Spectre-BHB, for the new hw AmpereOne (bsc#1211855, bsc#1205153).
    - CVE-2023-30456: Fixed an issue in arch/x86/kvm/vmx/nested.c with nVMX on x86_64 lacks consistency checks     for CR0 and CR4 (bsc#1210294).
    - CVE-2023-30772: Fixed race condition and resultant use-after-free in da9150_charger_remove     (bsc#1210329).
    - CVE-2023-31084: Fixed a blocking issue in drivers/media/dvb-core/dvb_frontend.c (bsc#1210783).
    - CVE-2023-3141: Fixed a use-after-free flaw in r592_remove in drivers/memstick/host/r592.c, that allowed     local attackers to crash the system at device disconnect (bsc#1212129).
    - CVE-2023-31436: Fixed an out-of-bounds write in qfq_change_class() because lmax can exceed QFQ_MIN_LMAX     (bsc#1210940).
    - CVE-2023-3161: Fixed shift-out-of-bounds in fbcon_set_font() (bsc#1212154).
    - CVE-2023-3220: Fixed a NULL pointer dereference flaw in dpu_crtc_atomic_check in     drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() (bsc#1212556).
    - CVE-2023-32233: Fixed a use-after-free in Netfilter nf_tables when processing batch requests     (bsc#1211043).
    - CVE-2023-33288: Fixed a use-after-free in bq24190_remove in drivers/power/supply/bq24190_charger.c     (bsc#1211590).
    - CVE-2023-3357: Fixed a NULL pointer dereference flaw in the AMD Sensor Fusion Hub driver (bsc#1212605).
    - CVE-2023-3358: Fixed a NULL pointer dereference flaw in the Integrated Sensor Hub (ISH) driver     (bsc#1212606).
    - CVE-2023-33951: Fixed a race condition that could have led to an information disclosure inside the     vmwgfx driver (bsc#1211593).
    - CVE-2023-33952: Fixed a double free that could have led to a local privilege escalation inside the     vmwgfx driver (bsc#1211595).
    - CVE-2023-35788: Fixed an out-of-bounds write in the flower classifier code via     TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets in fl_set_geneve_opt in net/sched/cls_flower.c (bsc#1212504).
    - CVE-2023-35823: Fixed a use-after-free flaw in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c (bsc#1212494).
    - CVE-2023-35828: Fixed a use-after-free flaw in renesas_usb3_remove in     drivers/usb/gadget/udc/renesas_usb3.c (bsc#1212513).
    - CVE-2023-35829: Fixed a use-after-free flaw in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c     (bsc#1212495).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
176987	Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-6149-1)	Nessus	Ubuntu Local Security Checks	2023/6/8	2024/8/28	high
177050	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6150-1)	Nessus	Ubuntu Local Security Checks	2023/6/9	2024/8/27	high
177326	Ubuntu 20.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6162-1)	Nessus	Ubuntu Local Security Checks	2023/6/14	2024/8/28	high
178361	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2023-2383)	Nessus	Huawei Local Security Checks	2023/7/18	2025/9/29	high
178920	Ubuntu 20.04 LTS : Linux kernel (IoT) vulnerabilities (USN-6256-1)	Nessus	Ubuntu Local Security Checks	2023/7/27	2024/9/19	critical
179540	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-2584)	Nessus	Huawei Local Security Checks	2023/8/8	2025/9/29	high
188850	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2023-2724)	Nessus	Huawei Local Security Checks	2024/1/16	2025/9/29	high
188958	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-2689)	Nessus	Huawei Local Security Checks	2024/1/16	2025/9/29	high
276356	TencentOS Server 3: kernel (TSSA-2023:0340)	Nessus	Tencent Local Security Checks	2025/11/20	2026/3/10	high
178179	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2809-1)	Nessus	SuSE Local Security Checks	2023/7/12	2025/9/25	high

检测

插件搜索

high

high

high

high

critical

high

high

high

high

high