The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0823 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)

    * kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

    * kernel: use-after-free in RDMA listen() (CVE-2021-4028)

    * kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

    * kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

    * kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

    * kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0819 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: improper initialization of the flags member of the new pipe_buffer (CVE-2022-0847)

    * kernel: Use After Free in unix_gc() which could result in a local privilege escalation (CVE-2021-0920)

    * kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container     breakout (CVE-2021-4154)

    * kernel: possible privileges escalation due to missing TLB flush (CVE-2022-0330)

    * kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS (CVE-2022-0435)

    * kernel: cgroups v1 release_agent feature may allow privilege escalation (CVE-2022-0492)

    * kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel symbol '__rt_mutex_init' is exported GPL-only in kernel 4.18.0-348.2.1.rt7.132.el8_5 (BZ#2038423)

    * kernel-rt: update RT source tree to the RHEL-8.5.z3 source tree (BZ#2045589)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0760-1 advisory.

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for     s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain     unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
    (CVE-2022-0516)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

  - An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive     information from kernel memory. (CVE-2022-25375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9245 advisory.

    - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann)  [Orabug: 33942325]     {CVE-2022-0847}
    - arm64: Use the clearbhb instruction in mitigations (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)  [Orabug: 33937423] {CVE-2022-23960}
    - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: Mitigate spectre style branch history side channels (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: Add part number for Arm Cortex-A77 (Rob Herring)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: Add percpu vectors for EL1 (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)  [Orabug:
    33937423] {CVE-2022-23960}
    - arm64: entry: Move the trampoline data page before the text page (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)  [Orabug: 33937423]     {CVE-2022-23960}
    - arm64: entry: Make the trampoline cleanup optional (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - arm64: entry.S: Add ventry overflow sanity checks (James Morse)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add initial retpoline support' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: asm: Use *_nospec variants for blr and br.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Add MIDR_APM_POTENZA.' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: insn: Add offset getter/setter for adr.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: alternatives: Add support for adr/adrp with offset in alt block.'     (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'BACKPORT: VARIANT 2: arm64: Use alternative framework for retpoline.' (Russell King)  [Orabug:
    33937423] {CVE-2022-23960}
    - Revert 'Arm64: add retpoline to cpu_show_spectre_v2' (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'arm64: retpoline: Don't use retpoline in KVM's HYP part.' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE' (Russell King)  [Orabug: 33937423] {CVE-2022-23960}
    - Revert 'uek-rpm: aarch64 config enable RETPOLINE OL8' (Russell King)  [Orabug: 33937423]     {CVE-2022-23960}
    - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)     [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)     [Orabug: 33937344]  {CVE-2021-26401}
    - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33937344]  {CVE-2021-26401}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug:
    33937344]  {CVE-2021-26401}
    - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - x86/speculation: Fix bug in retpoline mode on AMD with  (Patrick Colp)  [Orabug: 33937344]     {CVE-2021-26401}
    - netfilter: nf_tables_offload: incorrect flow offload action array size (Pablo Neira Ayuso)  [Orabug:
    33900416]  {CVE-2022-25636}
    - KVM: x86: nSVM: don't copy virt_ext from vmcb12 (Maxim Levitsky)  [Orabug: 33805849]  {CVE-2021-3653}     {CVE-2021-3656}
    - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin)  [Orabug: 33835810]     {CVE-2022-0330}
    - tipc: improve size validations for received domain records (Jon Maloy)  [Orabug: 33850801]     {CVE-2022-0435} {CVE-2022-0435}
    - USB: gadget: bRequestType is a bitfield, not a enum (Greg Kroah-Hartman)  [Orabug: 33739525]     {CVE-2021-39685}
    - USB: gadget: zero allocate endpoint 0 buffers (Greg Kroah-Hartman)  [Orabug: 33739525]  {CVE-2021-39685}
    - USB: gadget: detect too-big endpoint 0 requests (Greg Kroah-Hartman)  [Orabug: 33739525]     {CVE-2021-39685}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5362-1 advisory.

    Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local     attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636)

    Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that     hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local     attacker could potentially use this to expose sensitive information. (CVE-2022-23960)

    It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in     certain situations. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-23222)

    Max Kellermann discovered that the Linux kernel incorrectly handled Unix pipes. A local attacker could     potentially use this to modify any file that could be opened for reading. (CVE-2022-0847)

    Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly     restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain     administrative privileges. (CVE-2022-0492)

    William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux     kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker     could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-0185)

    Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that     hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local     attacker could potentially use this to expose sensitive information. (CVE-2022-0001)

    Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that     could result in a read-after-free. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2021-4083)

    It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2021-4090)

    Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size     correctly when pre-allocating space in some situations. A local attacker could use this to expose     sensitive information. (CVE-2021-4155)

    It was discovered that the AMD Radeon GPU driver in the Linux kernel did not properly validate writes in     the debugfs file system. A privileged attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2021-42327)

    Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform     a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or     possibly execute arbitrary code. (CVE-2022-0330)

    Samuel Page discovered that the Transparent Inter-Process Communication (TIPC) protocol implementation in     the Linux kernel contained a stack-based buffer overflow. A remote attacker could use this to cause a     denial of service (system crash) for systems that have a TIPC bearer configured. (CVE-2022-0435)

    It was discovered that the KVM implementation for s390 systems in the Linux kernel did not properly     prevent memory operations on PVM guests that were in non-protected mode. A local attacker could use this     to obtain unauthorized memory write access. (CVE-2022-0516)

    It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in     certain situations. A remote attacker could possibly use this to cause a denial of service (memory     exhaustion). (CVE-2022-0742)

    It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain     failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this     to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-9314 advisory.

    - netfilter: nf_tables: initialize registers in nft_do_chain() (Pablo Neira Ayuso)  [Orabug: 34012925]     {CVE-2022-1016}
    - btrfs: unlock newly allocated extent buffer after error (Qu Wenruo)  [Orabug: 33997138]  {CVE-2021-4149}
    - sr9700: sanity check for packet length (Oliver Neukum)  [Orabug: 33962706]  {CVE-2022-26966}
    - lib/timerqueue: Rely on rbtree semantics for next timer (Davidlohr Bueso)  [Orabug: 33406086]     {CVE-2021-20317} {CVE-2021-20317}
    - NFSv4: Handle case where the lookup of a directory fails (Trond Myklebust)  [Orabug: 33958155]     {CVE-2022-24448}
    - x86/speculation: Add knob for eibrs_retpoline_enabled (Patrick Colp)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Extend our code to properly support eibrs+lfence and eibrs+retpoline (Patrick Colp)     [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf)     [Orabug: 33937656]  {CVE-2021-26401}
    - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra)  [Orabug: 33937656]  {CVE-2021-26401}
    - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel))  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov)  [Orabug:
    33937656]  {CVE-2021-26401}
    - x86/speculation: Update ALTERNATIVEs to (more closely) match upstream (Patrick Colp)  [Orabug: 33937656]     {CVE-2021-26401}
    - x86/speculation: Fix bug in retpoline mode on AMD with 'spectre_v2=none' (Patrick Colp)  [Orabug:
    33937656]  {CVE-2021-26401}
    - ipv4: tcp: send zero IPID in SYNACK messages (Eric Dumazet)  [Orabug: 33917057]  {CVE-2020-36516}
    - ipv4: avoid using shared IP generator for connected sockets (Eric Dumazet)  [Orabug: 33917057]     {CVE-2020-36516}
    - lib/iov_iter: initialize 'flags' in new pipe_buffer (Max Kellermann)  [Orabug: 33910800]     {CVE-2022-0847}
    - udf: Restore i_lenAlloc when inode expansion fails (Jan Kara)  [Orabug: 33870267]  {CVE-2022-0617}
    - udf: Fix NULL ptr deref when converting from inline format (Jan Kara)  [Orabug: 33870267]     {CVE-2022-0617}
    - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Mathias Krause)  [Orabug: 33840433]     {CVE-2022-22942}
    - drm/i915: Flush TLBs before releasing backing store (Tvrtko Ursulin)  [Orabug: 33835811]     {CVE-2022-0330}
    - hugetlbfs: flush TLBs correctly after huge_pmd_unshare (Nadav Amit)  [Orabug: 33617219]  {CVE-2021-4002}
    - tipc: improve size validations for received domain records (Jon Maloy)  [Orabug: 33850803]     {CVE-2022-0435} {CVE-2022-0435}
    - cgroup-v1: Require capabilities to set release_agent (Eric W. Biederman)  [Orabug: 33825688]     {CVE-2022-0492}
    - Linux 4.14.257 (Greg Kroah-Hartman)   {CVE-2021-38199}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could     overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in     ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.
    (CVE-2020-25211)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
158805	RHEL 8 : kernel (RHSA-2022:0823)	Nessus	Red Hat Local Security Checks	2022/3/11	2024/11/7	high
158808	RHEL 8 : kernel-rt (RHSA-2022:0819)	Nessus	Red Hat Local Security Checks	2022/3/11	2024/11/7	high
159164	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:0760-1)	Nessus	SuSE Local Security Checks	2022/3/22	2023/7/14	high
159184	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9245)	Nessus	Oracle Linux Local Security Checks	2022/3/23	2024/10/22	high
159395	Ubuntu 20.04 LTS : Linux kernel (Intel IOTG) vulnerabilities (USN-5362-1)	Nessus	Ubuntu Local Security Checks	2022/4/1	2024/8/27	high
160189	Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2022-9314)	Nessus	Oracle Linux Local Security Checks	2022/4/25	2024/10/22	high
160765	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2022-0074)	Nessus	NewStart CGSL Local Security Checks	2022/5/9	2025/10/7	high

检测

插件搜索

high

high

high

high

high

high

high