The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3422-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the     machine (bnc#1202897).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6978 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6983 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0).

    Security Fix(es):

    * A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    * Information leak in the IPv6 implementation (CVE-2021-45485)

    * Information leak in the IPv4 implementation (CVE-2021-45486)

    * Incomplete cleanup of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * Incomplete cleanup of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * Incomplete cleanup in specific special register write operations (aka DRPW) (CVE-2022-21166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * DR, Ignore modify TTL if ConnectX-5 doesn't support it (BZ#2075549)

    * execve exit tracepoint not called (BZ#2106663)

    * Unable to boot RHEL-8.6 on Brazos max. config (Install is success) (BZ#2107475)

    * vmcore failed, _exitcode:139 error observed while capturing vmcore during fadump after memory remove.
    incomplete vmcore is captured. (BZ#2107490)

    * soft lockups under heavy I/O load to ahci connected SSDs (BZ#2110773)

    * Allow substituting custom vmlinux.h for the build (BZ#2116407)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3609-1 advisory.

    The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module     (bnc#1202154).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bnc#1196616).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
    - CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c     (bnc#1202960).
    - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to     crash the system or escalate their privileges (bnc#1203552).
    - CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a PCMCIA device while calling ioctl (bnc#1203987).
    - CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a USB device while calling open (bnc#1203992).
    - CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
    - CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD     move (bnc#1203622).
    - CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges     to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This     allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and     firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify     firmware updates (bnc#1202677).
    - CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a     DCCP socket. (bnc#1177471)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7171 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * backports from upstream for netfilter (BZ#2120635)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7110 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    * Information leak in scsi_ioctl() (CVE-2022-0494)

    * A kernel-info-leak issue in pfkey_register (CVE-2022-1353)

    * RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)

    * Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Add s390_iommu_aperture kernel parameter (BZ#2081324)

    * Blackscreen and hangup after resume from hibernate or S3 with DFGX WX3200 (BZ#2091065)

    * Update NVME subsystem with bug fixes and minor changes (BZ#2106017)

    * Fix parsing of nw_proto for IPv6 fragments (BZ#2106703)

    * vmcore failed, _exitcode:139 error observed while capturing vmcore during fadump after memory remove.
    incomplete vmcore is captured. (BZ#2107488)

    * 'disable_policy' is ignored for addresses configured on a down interface (BZ#2109971)

    * Backport request for new cpufreq.default_governor kernel command line parameter (BZ#2109996)

    * Panics in mpt3sas mpt3sas_halt_firmware() if mpt3sas_fwfault_debug=1 enabled when poweroff issued to     server (BZ#2111140)

    * IOMMU/DMA update for 8.7 (BZ#2111692)

    * Update Broadcom Emulex lpfc driver for RHEL8.7 with bug fixes (14.0.0.13) (BZ#2112103)

    * Incorrect Socket(s) & Core(s) per socket reported by lscpu command. (BZ#2112820)

    * Panic in ch_release() due to NULL ch->device pointer, backport upstream fix (BZ#2115965)

    * pyverbs-tests fail over qede IW HCAs on test_query_rc_qp (tests.test_qp.QPTest) (BZ#2119122)

    * qedi shutdown handler hangs upon reboot (BZ#2119847)

    * cache link_info for ethtool (BZ#2120197)

    * Important iavf bug fixes (BZ#2120225)

    * Hibernate crash with Aquantia 2.5/5 Gb LAN card (BZ#2124966)

    * While using PTimekeeper the qede driver produces excessive log messages (BZ#2125477)

    * general protection fault handling rpc_xprt.timer (BZ#2126184)

    * Not enough device MSI-X vectors (BZ#2126482)

    * Atlantic driver panic on wakeup after hybernate (BZ#2127845)

    * Memory leak in vxlan_xmit_one (BZ#2131255)

    * Missing hybernate/resume fixes (BZ#2131936)

    Enhancement(s):

    * Update smartpqi driver to latest upstream Second Set of Patches (BZ#2112354)

    * qed/qede/qedr - driver updates to latest upstream (BZ#2120611)

    * Update qedi driver to latest upstream (BZ#2120612)

    * Update qedf driver to latest upstream (BZ#2120613)

    * Include the support for new NVIDIA Mobile GFX GA103 on ADL Gen Laptops (BZ#2127122)

    * Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129923)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:7137 advisory.

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7338 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    * RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900)

    * Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Update to the latest RHEL7.9.z18 source tree (BZ#2117337)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-204450605References: Upstream kernel (CVE-2021-39634)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux     Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
    (CVE-2022-0812)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - An out-of-bounds memory access flaw was found in the Linux kernel Intel's iSMT SMBus host controller     driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input     data. This flaw allows a local user to crash the system. (CVE-2022-2873)

  - A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is     disabled by default, it could allow an attacker to crash the system or have other memory-corruption side     effects. (CVE-2022-2938)

  - A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4030-1 advisory.

    This update for the Linux Kernel 4.12.14-122_130 fixes several issues.

    The following security issues were fixed:

    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bnc#1204168).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7134 advisory.

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - It was discovered that a nft object or expression could reference a nft set on a different nft table,     leading to a use-after-free once that table was deleted. (CVE-2022-2586)

  - It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0. (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4022 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The iscsi target deadlocks when the same host acts as an initiator to itself (i.e. connects via     127.0.0.1) (BZ#2183540)

    * Double free issue in filelayout_alloc_commit_info (BZ#2212868)

    * RHEL 7.2: XFS inode cluster corruption (BZ#2213360)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414440 advisory.

    It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3951:15 advisory.

    * A use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)
      * Information leak in scsi_ioctl() (CVE-2022-0494)
      * A kernel-info-leak issue in pfkey_register (CVE-2022-1353)
      * RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)
      * Branch Type Confusion (non-retbleed) (CVE-2022-23825)
      * RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
165562	SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:3422-1)	Nessus	SuSE Local Security Checks	2022/9/29	2026/6/25	high
166180	RHEL 8 : kpatch-patch (RHSA-2022:6978)	Nessus	Red Hat Local Security Checks	2022/10/18	2024/11/7	high
166199	RHEL 8 : kernel (RHSA-2022:6983)	Nessus	Red Hat Local Security Checks	2022/10/18	2024/11/7	high
166257	SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2022:3609-1)	Nessus	SuSE Local Security Checks	2022/10/19	2026/6/25	high
166470	RHEL 7 : kernel (RHSA-2022:7171)	Nessus	Red Hat Local Security Checks	2022/10/25	2024/11/7	high
166478	RHEL 8 : kernel (RHSA-2022:7110)	Nessus	Red Hat Local Security Checks	2022/10/25	2025/9/12	high
166510	AlmaLinux 8 : kpatch-patch (ALSA-2022:7137)	Nessus	Alma Linux Local Security Checks	2022/10/25	2024/1/15	high
166878	RHEL 7 : kernel-rt (RHSA-2022:7338)	Nessus	Red Hat Local Security Checks	2022/11/3	2025/9/12	high
167388	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2022-2767)	Nessus	Huawei Local Security Checks	2022/11/14	2024/6/26	high
167753	SUSE SLES12: kernel-livepatch-4_12_14-150000_150_98-default / etc (SUSE-SU-2022:4030-1)	Nessus	SuSE Local Security Checks	2022/11/17	2026/6/26	high
167807	Rocky Linux 8 : kernel-rt (RLSA-2022:7134)	Nessus	Rocky Linux Local Security Checks	2022/11/17	2024/1/18	high
169794	EulerOS Virtualization 2.9.1 : kernel (EulerOS-SA-2023-1193)	Nessus	Huawei Local Security Checks	2023/1/10	2024/6/26	high
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2026/6/3	high
178119	RHEL 7 : kernel (RHSA-2023:4022)	Nessus	Red Hat Local Security Checks	2023/7/11	2024/11/7	high
203949	Photon OS 3.0: Linux PHSA-2022-3.0-0433	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/25	high
267221	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414440)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/15	high
293378	MiracleLinux 8 : kernel-4.18.0-372.32.1.el8_6 (AXSA:2022-3951:15)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/4	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high