The version of kernel-generic installed on the remote host is prior to 5.15.27 / 5.15.27_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-067-01 advisory.

  - A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c     in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system     Confidentiality. This flaw affects kernel versions prior to 5.14 rc1. (CVE-2022-0487)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB     Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array     index and ones associated with NULL function pointer retrieval). Memory corruption might occur.
    (CVE-2022-25258)

  - An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive     information from kernel memory. (CVE-2022-25375)

  - net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges     because of a heap out-of-bounds write. This is related to nf_tables_offload. (CVE-2022-25636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0768-1 advisory.

    The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.


    Transient execution side-channel attacks attacking the Branch History Buffer (BHB),     named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

    The following security bugs were fixed:

    - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
    - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
    - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-     only) files (bsc#1196584).
    - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could     crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
    - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in     kernel_read_file_from_fd() (bsc#1196155).
    - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a     move_data_page NULL pointer dereference (bsc#1195987).
    - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
    - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in     drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
    - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed     bypassing namespace isolation unexpectedly (bsc#1195543).
    - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries     to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR     should have occured, but the server instead returned uninitialized data in the file descriptor     (bsc#1195612).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0767-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

    Transient execution side-channel attacks attacking the Branch History Buffer (BHB),     named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

    The following security bugs were fixed:

    - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
    - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
    - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-     only) files (bsc#1196584).
    - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could     crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
    - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in     kernel_read_file_from_fd() (bsc#1196155).
    - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a     move_data_page NULL pointer dereference (bsc#1195987).
    - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
    - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in     drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
    - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed     bypassing namespace isolation unexpectedly (bsc#1195543).
    - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries     to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR     should have occured, but the server instead returned uninitialized data in the file descriptor     (bsc#1195612).
    - CVE-2021-45095: Fixed refcount leak in pep_sock_accept in net/phonet/pep.c (bsc#1193867).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0759-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes.


    Transient execution side-channel attacks attacking the Branch History Buffer (BHB),     named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

    The following security bugs were fixed:

    - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
    - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
    - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-     only) files (bsc#1196584).
    - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could     crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
    - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in     kernel_read_file_from_fd() (bsc#1196155).
    - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a     move_data_page NULL pointer dereference (bsc#1195987).
    - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
    - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in     drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
    - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed     bypassing namespace isolation unexpectedly (bsc#1195543).
    - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries     to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR     should have occured, but the server instead returned uninitialized data in the file descriptor     (bsc#1195612).
    - CVE-2022-25375: The RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command.
    Attackers can obtain sensitive information from kernel memory (bsc#1196235).
    - CVE-2022-0516: Fixed missing check in ioctl related to KVM in s390 allows kernel memory read/write     (bsc#1195516).
    - CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests,     which could have lead to memory corruption (bsc#1196096).
    - CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0757-1 advisory.

    The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.


    Transient execution side-channel attacks attacking the Branch History Buffer (BHB),     named 'Branch Target Injection' and 'Intra-Mode Branch History Injection' are now mitigated.

    The following security bugs were fixed:

    - CVE-2022-0001: Fixed Branch History Injection vulnerability (bsc#1191580).
    - CVE-2022-0002: Fixed Intra-Mode Branch Target Injection vulnerability (bsc#1191580).
    - CVE-2022-0847: Fixed a vulnerability were a local attackers could overwrite data in arbitrary (read-     only) files (bsc#1196584).
    - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could     crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079)
    - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in     kernel_read_file_from_fd() (bsc#1196155).
    - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a     move_data_page NULL pointer dereference (bsc#1195987).
    - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897).
    - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in     drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516).
    - CVE-2022-0492: Fixed a privilege escalation related to cgroups v1 release_agent feature, which allowed     bypassing namespace isolation unexpectedly (bsc#1195543).
    - CVE-2022-24448: Fixed an issue in fs/nfs/dir.c. If an application sets the O_DIRECTORY flag, and tries     to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR     should have occured, but the server instead returned uninitialized data in the file descriptor     (bsc#1195612).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0825 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2036888)

    Security Fix(es):

    * kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)

    * kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

    * kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container     breakout (CVE-2021-4154)

    * kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

    * kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

    * kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

    * kernel: missing check in ioctl allows kernel memory read/write (CVE-2022-0516)

    * kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Intel QAT Kernel power up fix (BZ#2016437)

    * RHEL8.4 seeing scsi_dma_map failed with mpt3sas driver and affecting performance (BZ#2018928)

    * [Lenovo 8.4 bug] audio_HDMI certification failed on RHEL 8.4GA (No hdmi out) (BZ#2027335)

    * [RHEL-8.5][4.18.0-323.el8.ppc64le][POWER8/9/10] security_flavor mode is not set back to zero post online     migration (BZ#2027448)

    * iommu/amd: Fix unable to handle page fault due to AVIC (BZ#2030854)

    * [Lenovo 8.4 bug]The VGA display shows no signal (black screen) when install RHEL8.4(beta or rc1) in the     legacy BIOS mode. (BZ#2034949)

    * Double free of kmalloc-64  cache   struct ib_port->pkey_group from module ib_core  . (BZ#2038724)

    * Bus error with huge pages enabled (BZ#2039015)

    * RHEL8 - kvm: floating interrupts may get stuck (BZ#2040769)

    * Data corruption on small files served by httpd, which is backed by cifs-mount (BZ#2041529)

    * Add a net/mlx5 patch for Hardware Offload Fix (BZ#2042663)

    * Windows guest random Bsod when 'hv-tlbflush' enlightenment is enabled (BZ#2043237)

    * DNS lookup failures when run two times in a row (BZ#2043548)

    * net/sched: Fix ct zone matching for invalid conntrack state (BZ#2043550)

    * Kernel 4.18.0-348.2.1 secpath_cache memory leak involving strongswan tunnel (BZ#2047427)

    * OCP node XFS metadata corruption after numerous reboots (BZ#2049292)

    * Broadcom bnxt_re: RDMA stats are not incrementing (BZ#2049684)

    * ice: bug fix series for 8.6 (BZ#2051951)

    * panic while looking up a symlink due to NULL i_op->get_link (BZ#2052558)

    * ceph omnibus backport for RHEL-8.6.0 (BZ#2053725)

    * SCTP peel-off with SELinux and containers in OCP (BZ#2054112)

    * Selinux  is not  allowing SCTP connection setup between inter pod communication in enforcing mode     (BZ#2054117)

    * dnf fails with fsync() over local repository present on CIFS mount point (BZ#2055824)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to     the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be     encountered. In one case, an error encountered earlier might be discarded by later processing, resulting     in the caller assuming successful mapping, and hence subsequent operations trying to access space that     wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery     from the error. This affects drivers/block/xen-blkback/blkback.c. (CVE-2021-26930)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the     group key handshake, allowing an attacker within radio range to replay frames from access points to     clients. (CVE-2017-13080)

  - It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable     to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on     network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph     service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable. (CVE-2018-1128)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat     fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets,     independent of the network configuration. (CVE-2020-26142)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - A flaw was found in the Linux kernel's implementation of MIDI, where an attacker with a local account and     the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to     this specific memory while freed and before use causes the flow of execution to change and possibly allow     for memory corruption or privilege escalation. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-27786)

  - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References:
    Upstream kernel (CVE-2021-0920)

  - A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
    (CVE-2021-20321)

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a process's     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in     drivers/media/v4l2-core/v4l2-ioctl.c has a memory leak for large arguments, aka CID-fb18802a338b.
    (CVE-2021-30002)

  - Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow     an authenticated user to potentially enable denial of service via local access. (CVE-2021-33098)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in     any net namespace because these changes are leaked into all other net namespaces. This is related to the     NF_SYSCTL_CT_MAX, NF_SYSCTL_CT_EXPECT_MAX, and NF_SYSCTL_CT_BUCKETS sysctls. (CVE-2021-38209)

  - A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some     regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the     memory pages. A local user could use this flaw to get unauthorized access to some data. (CVE-2021-4002)

  - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket     file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race     condition. This flaw allows a local user to crash the system or escalate their privileges on the system.
    This flaw affects Linux kernel versions prior to 5.16-rc4. (CVE-2021-4083)

  - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an     improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of     service (DOS) due to a deadlock problem. (CVE-2021-4149)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows     an attacker (who can connect a crafted USB device) to cause a denial of service (skb_over_panic).
    (CVE-2021-43976)

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds     memory access when an inode has an invalid last xattr entry. (CVE-2021-45469)

  - In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information     leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based     attackers can typically choose among many IPv6 source addresses. (CVE-2021-45485)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-347.el9 build changelog.

  - A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

  - An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-     Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of     user-supplied sizes for the MSG_CRYPTO message type. (CVE-2021-43267)

  - A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could     happen if removing device (that is not common to remove video card physically without power-off, but same     happens if unbind the driver). (CVE-2020-27820)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
158743	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2022-067-01)	Nessus	Slackware Local Security Checks	2022/3/9	2023/1/16	high
158751	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:0768-1)	Nessus	SuSE Local Security Checks	2022/3/9	2025/9/25	high
158752	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2022:0767-1)	Nessus	SuSE Local Security Checks	2022/3/9	2025/9/25	high
158753	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:0759-1)	Nessus	SuSE Local Security Checks	2022/3/9	2025/9/25	high
158758	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:0757-1)	Nessus	SuSE Local Security Checks	2022/3/9	2025/9/25	high
158822	RHEL 8 : kernel (RHSA-2022:0825)	Nessus	Red Hat Local Security Checks	2022/3/11	2025/3/6	high
161629	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2022-1780)	Nessus	Huawei Local Security Checks	2022/5/27	2023/12/7	high
161565	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2022-1735)	Nessus	Huawei Local Security Checks	2022/5/26	2023/12/7	high
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	2024/2/29	2025/9/25	critical

检测

插件搜索

high

high

high

high

high

high

high

high

critical