The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0113 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: vmwgfx: reference count issue leads to use-after-free in surface handling (CVE-2023-5633)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * Kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Backport OVS l4 Symmetric Hashing to rhel-8 (JIRA:RHEL-12746)

    * Unbounded memory usage by TCP for receive buffers (JIRA:RHEL-15096)

    * various kind of guests freeze on rhel 8.8 (JIRA:RHEL-15121)

    * RHEL 8: netfilter: conntrack: Fix gre tunneling over ipv6  (JIRA:RHEL-15259)

    * NFSv4.1 needs to handle ENOENT error from GETDEVICEINFO (JIRA:RHEL-16407)

    * DM multipath showing failed path for an nvme-o-FC LUN when performing I/O operations (JIRA:RHEL-14718)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5261 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating     system.

    Security Fix(es):

    * kernel: af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-4622)

    * kernel: KEV - Beaky Buzzard (CVE-2024-36971)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1306 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch     requests (CVE-2023-3390)

    * out-of-bounds access in relay_file_read (CVE-2023-3268)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (CVE-2023-38409)

    * Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue ()

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * use after free in unix_stream_sendpage (CVE-2023-4622)

    * bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its     child's sibling_list (CVE-2023-5717)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

    * use-after-free in IPv4 IGMP (CVE-2023-6932)

    * GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

    * refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (JIRA:RHEL-1107)

    * out-of-bounds access in relay_file_read (JIRA:RHEL-1749)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18085)

    * NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19524)

    * update RT source tree to the latest RHEL-9.0.z Batch 15 (JIRA:RHEL-21555)

    * Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-9285)

    * A heap out-of-bounds write (JIRA:RHEL-18011)

    * Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19398)

    * A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19534)

    * Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe (JIRA:RHEL-8980)

    * various flaws (JIRA:RHEL-16150)

    * refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20311)

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-20502)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (JIRA:RHEL-22095)

    * use-after-free in smb2_is_status_io_timeout() (JIRA:RHEL-15171)

    * use-after-free in IPv4 IGMP (JIRA:RHEL-21658)

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (JIRA:RHEL-8996)

    * GSM multiplexing race condition leads to privilege escalation (JIRA:RHEL-19968)

    * NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22751)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier     (JIRA:RHEL-26381)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities:

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through     5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.
    (CVE-2020-36158)

  - Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version     26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an     escalation of privilege via local access. (CVE-2020-12362)

  - usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because     a transfer occurs without a reference, aka CID-056ad39ee925. (CVE-2020-12464)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.128-80.144. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-026 advisory.

    Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

    The fix for XSA-423 added logic to Linux'es netback driver to deal witha frontend splitting a packet in a     way such that not all of the headerswould come in one piece.  Unfortunately the logic introduced     theredidn't account for the extreme case of the entire packet being splitinto as many pieces as permitted     by the protocol, yet still beingsmaller than the area that's specially dealt with to keep all     (possible)headers together.  Such an unusual packet would therefore trigger abuffer overrun in the driver.
    (CVE-2023-34319)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

    A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of     XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data     to userspace. (CVE-2023-3773)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the     chain's owner rule can also release the objects in certain circumstances.

    We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777)

    A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

    A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    On an error when building a nftables rule, deactivating immediate expressions in     nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used.

    We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue. (CVE-2023-4128)

    netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (CVE-2023-4147)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 (tun: tun_chr_open(): correctly initialize socket uid), - 66b2c338adce (tap: tap_open():
    correctly initialize socket uid), pass inode->i_uid to sock_init_data_uid() as the last parameter and     that turns out to not be accurate. (CVE-2023-4194)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.

    When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into     the new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. (CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the     new instance of the filter. This causes a problem when updating a filter bound to a class, as     tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the     still referenced class and allowing it to be deleted, leading to a use-after-free.

    We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81. (CVE-2023-4208)

    A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation     of the file name reconstruction function, which is responsible for reading file name entries from a     directory index and merging file name parts belonging to one file into a single long file name. Since the     file name characters are copied into a stack variable, a local privileged attacker could use this flaw to     overflow the kernel stack. (CVE-2023-4273)

    A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux     Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which     can result in a memory leak. (CVE-2023-4569)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.

    The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without     locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that     is being released by garbage collection, resulting in use-after-free.

    We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: add NULL check in xfrm_update_ae_params (CVE-2023-53147)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Fix uninitialized array access for some pathnames (CVE-2023-53165)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix possible memory leak if device_add() fails (CVE-2023-53174)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: exit gracefully if reloc roots don't match (CVE-2023-53183)

    In the Linux kernel, the following vulnerability has been resolved:

    vxlan: Fix nexthop hash size (CVE-2023-53192)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix warning in cifs_smb3_do_mount() (CVE-2023-53230)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (CVE-2023-53245)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/mlx5: Return the firmware result upon destroying QP/RQ (CVE-2023-53286)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_modeset_probe (CVE-2023-53288)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: fix overlap expiration walk (CVE-2023-53304)

    In the Linux kernel, the following vulnerability has been resolved:

    nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (CVE-2023-53311)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/ntfs3: Enhance sanity check while generating attr_list (CVE-2023-53328)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix BUG_ON condition in btrfs_cancel_balance (CVE-2023-53339)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dcb: choose correct policy to parse DCB_ATTR_BCN (CVE-2023-53369)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (CVE-2023-53469)

    In the Linux kernel, the following vulnerability has been resolved:

    powerpc/rtas_flash: allow user copy to flash block cache objects (CVE-2023-53487)

    In the Linux kernel, the following vulnerability has been resolved:

    xfrm: fix slab-use-after-free in decode_session6 (CVE-2023-53500)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-mmio: don't break lifecycle of vm_dev (CVE-2023-53515)

    In the Linux kernel, the following vulnerability has been resolved:

    ip_vti: fix potential slab-use-after-free in decode_session6 (CVE-2023-53559)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Make sure kthread is running before map update returns (CVE-2023-53577)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Release folio lock on fscache read hit. (CVE-2023-53593)

    In the Linux kernel, the following vulnerability has been resolved:

    tunnels: fix kasan splat when generating ipv4 pmtu error (CVE-2023-53600)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: reject invalid reloc tree root keys with stack dump (CVE-2023-53618)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf, cpumap: Handle skb as well when clean up ptr_ring (CVE-2023-53660)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: fix refcount underflow in error path (CVE-2023-53698)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Do not swap cpu_buffer during resize process (CVE-2023-53718)

    In the Linux kernel, the following vulnerability has been resolved:

    ip6_vti: fix slab-use-after-free in decode_session6 (CVE-2023-53821)

    In the Linux kernel, the following vulnerability has been resolved:

    dccp: fix data-race around dp->dccps_mss_cache (CVE-2023-53839)

    In the Linux kernel, the following vulnerability has been resolved:

    usb-storage: alauda: Fix uninit-value in alauda_check_media() (CVE-2023-53847)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix warning when putting transaction with qgroups enabled after abort (CVE-2023-53865)

    In the Linux kernel, the following vulnerability has been resolved:

    net: do not allow gso_size to be set to GSO_BY_FRAGS (CVE-2023-54051)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/client: Fix memory leak in drm_client_target_cloned (CVE-2023-54091)

    In the Linux kernel, the following vulnerability has been resolved:

    fs: Protect reconfiguration of sb read-write from racing writes (CVE-2023-54099)

    In the Linux kernel, the following vulnerability has been resolved:

    net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (CVE-2023-54155)

    In the Linux kernel, the following vulnerability has been resolved:

    keys: Fix linking a duplicate key to a keyring's assoc_array (CVE-2023-54170)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Disable preemption in bpf_event_output (CVE-2023-54173)

    In the Linux kernel, the following vulnerability has been resolved:

    quota: fix warning in dqgrab() (CVE-2023-54177)

    In the Linux kernel, the following vulnerability has been resolved:

    exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (CVE-2023-54194)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Fix warning in trace_buffered_event_disable() (CVE-2023-54211)

    In the Linux kernel, the following vulnerability has been resolved:

    serial: 8250: Fix oops for port->pm on uart_change_pm() (CVE-2023-54220)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (CVE-2023-54251)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/ttm: Don't leak a resource on eviction error (CVE-2023-54254)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: fix potential oops in cifs_oplock_break (CVE-2023-54258)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: zoned: fix memory leak after finding block group with super blocks (CVE-2023-54297)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5492 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2023-1206 It was discovered that the networking stack permits     attackers to force hash collisions in the IPv6 connection lookup table, which may result in denial of     service (significant increase in the cost of lookups, increased CPU utilization). CVE-2023-1989 Zheng Wang     reported a race condition in the btsdio Bluetooth adapter driver that can lead to a use-after-free. An     attacker able to insert and remove SDIO devices can use this to cause a denial of service (crash or memory     corruption) or possibly to run arbitrary code in the kernel. CVE-2023-2430 Xingyuan Mo discovered that the     io_uring subsystem did not properly handle locking when the target ring is configured with IOPOLL, which     may result in denial of service. CVE-2023-2898 It was discovered that missing sanitising in the f2fs file     system may result in denial of service if a malformed file system is accessed. CVE-2023-3611 It was     discovered that an out-of-bounds write in the traffic control subsystem for the Quick Fair Queueing     scheduler (QFQ) may result in denial of service or privilege escalation. CVE-2023-3772 Lin Ma discovered a     NULL pointer dereference flaw in the XFRM subsystem which may result in denial of service. CVE-2023-3773     Lin Ma discovered a flaw in the XFRM subsystem, which may result in denial of service for a user with the     CAP_NET_ADMIN capability in any user or network namespace. CVE-2023-3776, CVE-2023-4128, CVE-2023-4206,     CVE-2023-4207, CVE-2023-4208 It was discovered that a use-after-free in the cls_fw, cls_u32 and cls_route     network classifiers may result in denial of service or potential local privilege escalation. CVE-2023-3777     Kevin Rich discovered a use-after-free in Netfilter when flushing table rules, which may result in local     privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.
    CVE-2023-3863 It was discovered that a use-after-free in the NFC implementation may result in denial of     service, an information leak or potential local privilege escalation. CVE-2023-4004 It was discovered that     a use-after-free in Netfilter's implementation of PIPAPO (PIle PAcket POlicies) may result in denial of     service or potential local privilege escalation for a user with the CAP_NET_ADMIN capability in any user     or network namespace. CVE-2023-4015 Kevin Rich discovered a use-after-free in Netfilter when handling     bound chain deactivation in certain circumstances, may result in denial of service or potential local     privilege escalation for a user with the CAP_NET_ADMIN capability in any user or network namespace.
    CVE-2023-4132 A use-after-free in the driver for Siano SMS1xxx based MDTV receivers may result in local     denial of service. CVE-2023-4147 Kevin Rich discovered a use-after-free in Netfilter when adding a rule     with NFTA_RULE_CHAIN_ID, which may result in local privilege escalation for a user with the CAP_NET_ADMIN     capability in any user or network namespace. CVE-2023-4155 Andy Nguyen discovered a flaw in the KVM     subsystem allowing a KVM guest using EV-ES or SEV-SNP to cause a denial of service. CVE-2023-4194 A type     confusion in the implementation of TUN/TAP network devices may allow a local user to bypass network     filters. CVE-2023-4273 Maxim Suhanov discovered a stack overflow in the exFAT driver, which may result in     local denial of service via a malformed file system. CVE-2023-4569 lonial con discovered flaw in the     Netfilter subsystem, which may allow a local attacker to cause a double-deactivations of catchall     elements, which results in a memory leak. CVE-2023-4622 Bing-Jhong Billy Jheng discovered a use-after-free     within the Unix domain sockets component, which may result in local privilege escalation. CVE-2023-20588     Jana Hofmann, Emanuele Vannacci, Cedric Fournet, Boris Koepf and Oleksii Oleksenko discovered that on some     AMD CPUs with the Zen1 micro architecture an integer division by zero may leave stale quotient data from a     previous division, resulting in a potential leak of sensitive data. CVE-2023-34319 Ross Lagerwall     discovered a buffer overrun in Xen's netback driver which may allow a Xen guest to cause denial of service     to the virtualisation host my sending malformed packets. CVE-2023-40283 A use-after-free was discovered in     Bluetooth L2CAP socket handling. For the stable distribution (bookworm), these problems have been fixed in     version 6.1.52-1. This update is released without armel builds. Changes in the new stable series import     cause a substantial increase of the compressed image for marvell flavour. This issue will be addressed in     a future linux update. We recommend that you upgrade your linux packages. For the detailed security status     of linux please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h-nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system.(CVE-2023-42753)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue().We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8.(CVE-2023-4921)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.When u32_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.(CVE-2023-4208)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.(CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free.We recommend upgrading past commit     b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.(CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free.We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f.(CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free.We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.(CVE-2023-4622)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.(CVE-2023-4128)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 ('tun: tun_chr_open(): correctly initialize socket uid'), - 66b2c338adce ('tap: tap_open():
    correctly initialize socket uid'), pass 'inode-i_uid' to sock_init_data_uid() as the last parameter and     that turns out to not be accurate.(CVE-2023-4194)

    A flaw was found in the Linux kernels IP framework for transforming packets (XFRM subsystem). This     issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.(CVE-2023-3772)

    In multiple functions  of io_uring.c, there is a possible kernel memory corruption due to improper     locking. This could lead to local escalation of privilege in the kernel with System execution privileges     needed. User interaction is not needed for exploitation.(CVE-2023-21400)

    A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernels IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%.(CVE-2023-1206)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h-nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system.(CVE-2023-42753)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue().We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8.(CVE-2023-4921)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.When u32_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.(CVE-2023-4208)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.(CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free.We recommend upgrading past commit     b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.(CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free.We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f.(CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free.We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.(CVE-2023-4622)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.(CVE-2023-4128)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 ('tun: tun_chr_open(): correctly initialize socket uid'), - 66b2c338adce ('tap: tap_open():
    correctly initialize socket uid'), pass 'inode-i_uid' to sock_init_data_uid() as the last parameter and     that turns out to not be accurate.(CVE-2023-4194)

    A flaw was found in the Linux kernels IP framework for transforming packets (XFRM subsystem). This     issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.(CVE-2023-3772)

    In multiple functions  of io_uring.c, there is a possible kernel memory corruption due to improper     locking. This could lead to local escalation of privilege in the kernel with System execution privileges     needed. User interaction is not needed for exploitation.(CVE-2023-21400)

    A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernels IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%.(CVE-2023-1206)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0593 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
187898	RHEL 8 : kernel (RHSA-2024:0113)	Nessus	Red Hat Local Security Checks	2024/1/10	2025/3/6	high
205466	RHEL 7 : kernel (RHSA-2024:5261)	Nessus	Red Hat Local Security Checks	2024/8/13	2024/11/7	high
192035	RHEL 9 : kernel-rt (RHSA-2024:1306)	Nessus	Red Hat Local Security Checks	2024/3/13	2025/3/6	critical
180566	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-039 (ALASKERNEL-5.10-2023-039)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2026/2/11	high
206835	NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2024-0056)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2025/9/24	high
180567	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-026 (ALASKERNEL-5.15-2023-026)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2026/2/11	high
181209	Debian DSA-5492-1 : linux - security update	Nessus	Debian Local Security Checks	2023/9/10	2025/9/24	high
188802	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2023-3501)	Nessus	Huawei Local Security Checks	2024/1/16	2025/9/25	high
188939	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2023-3182)	Nessus	Huawei Local Security Checks	2024/1/16	2025/9/25	high
189803	RHEL 8 : kpatch-patch (RHSA-2024:0593)	Nessus	Red Hat Local Security Checks	2024/1/30	2024/11/7	high

检测

插件搜索

high

high

critical

high

high

high

high

high

high

high