The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4871-1 advisory.

    This update for the Linux Kernel 5.3.18-150300_59_106 fixes several issues.

    The following security issues were fixed:

    - CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited     to achieve local privilege escalation. (bsc#1215097)
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215442).
    - CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being     incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege     escalation, and container escape. (bsc#1215519)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4872-1 advisory.

    This update for the Linux Kernel 5.14.21-150400_24_81 fixes several issues.

    The following security issues were fixed:

    - CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local     privilege escalation (bsc#1213584).
    - CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited     to achieve local privilege escalation. (bsc#1215097)
    - CVE-2023-5345: Fixed an use-after-free vulnerability in the fs/smb/client component which could be     exploited to achieve local privilege escalation. (bsc#1215971)
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215442).
    - CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being     incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege     escalation, and container escape. (bsc#1215519)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12094 advisory.

    - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
    - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858}
    - can: af_can: fix NULL pointer dereference in can_rcv_filter (Oliver Hartkopp) {CVE-2023-2166}
    - RDMA/core: Fix resolve_prepare_src error cleanup (Patrisious Haddad) {CVE-2023-2176}
    - netfilter: nf_tables: skip bound chain on rule flush (Pablo Neira Ayuso} {CVE-2023-3777}
    - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
    - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Pablo Neira Ayuso) {CVE-2023-4015}
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) {CVE-2023-4622}
    - nvmet-tcp: Fix a possible UAF in queue intialization setup (Sagi Grimberg) {CVE-2023-5178}
    - fbcon: set_con2fb_map needs to set con2fb_map! (Daniel Vetter) {CVE-2023-38409}
    - fbcon: Fix error paths in set_con2fb_map (Daniel Vetter) {CVE-2023-38409}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) {CVE-2023-40283)
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)     {CVE-2023-42753}
    - x86/sev: Check IOBM for IOIO exceptions from user-space (Joerg Roedel) {CVE-2023-46813}
    - x86/sev: Disable MMIO emulation from user mode (Borislav Petkov) {CVE-2023-46813}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0562 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * LPAR is crashed by Phyp when doing DLPAR CPU operations (BZ#2193378)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2003 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer     dereference (CVE-2020-36558)

    * kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: irdma: Improper access control (CVE-2023-25775)

    Bug Fix(es):

    * kernel-rt: Update RT source tree to the latest RHEL-7.9z30 batch [rhel-7.9.z] (JIRA:RHEL-26440)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0461 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: vmwgfx: reference count issue leads to use-after-free in surface handling (CVE-2023-5633)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c (CVE-2022-36402)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0554 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7723:11 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.
    Security fixes:
      * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)
      * Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)
      * kernel: irdma: Improper access control (CVE-2023-25775)
      * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)
      * kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer     dereference (CVE-2020-36558)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0113 advisory.

  - An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU     component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local     attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-36402)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled address, potentially     leading to information disclosure. (CVE-2023-20569)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-     after-free flaw in the way memory objects were handled when they were being used to store a surface. When     running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially     use this flaw to escalate their privileges. (CVE-2023-5633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12069 advisory.

    - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-2162}
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage() {CVE-2023-4622}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This     vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of     BlueZ. Authentication is not required to exploit this vulnerability. The specific flaw exists within the     implementation of the HID over GATT Profile. The issue results from the lack of authorization prior to     allowing access to functionality. An attacker can leverage this vulnerability to execute code in the     context of the current user. Was ZDI-CAN-25177. (CVE-2024-8805)

  - A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause     a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation. (CVE-2023-5178)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix not cleanup led when     bt_init fails bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is     not called to unregister it. This can cause panic if the argument bluetooth-power in text is freed and     then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address:
    ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0     led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0     (CVE-2022-48971)

  - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix crash when replugging     CSR fake controllers It seems fake CSR 5.0 clones can cause the suspend notifier to be registered twice     causing the following kernel panic: [ 71.986122] Call Trace: [ 71.986124] <TASK> [ 71.986125]     blocking_notifier_chain_register+0x33/0x60 [ 71.986130] hci_register_dev+0x316/0x3d0 [bluetooth     99b5497ea3d09708fa1366c1dc03288bf3cca8da] [ 71.986154] btusb_probe+0x979/0xd85 [btusb     e1e0605a4f4c01984a4b9c8ac58c3666ae287477] [ 71.986159] ? __pm_runtime_set_status+0x1a9/0x300 [ 71.986162]     ? ktime_get_mono_fast_ns+0x3e/0x90 [ 71.986167] usb_probe_interface+0xe3/0x2b0 [ 71.986171]     really_probe+0xdb/0x380 [ 71.986174] ? pm_runtime_barrier+0x54/0x90 [ 71.986177]
    __driver_probe_device+0x78/0x170 [ 71.986180] driver_probe_device+0x1f/0x90 [ 71.986183]
    __device_attach_driver+0x89/0x110 [ 71.986186] ? driver_allows_async_probing+0x70/0x70 [ 71.986189]     bus_for_each_drv+0x8c/0xe0 [ 71.986192] __device_attach+0xb2/0x1e0 [ 71.986195] bus_probe_device+0x92/0xb0     [ 71.986198] device_add+0x422/0x9a0 [ 71.986201] ? sysfs_merge_group+0xd4/0x110 [ 71.986205]     usb_set_configuration+0x57a/0x820 [ 71.986208] usb_generic_driver_probe+0x4f/0x70 [ 71.986211]     usb_probe_device+0x3a/0x110 [ 71.986213] really_probe+0xdb/0x380 [ 71.986216] ?     pm_runtime_barrier+0x54/0x90 [ 71.986219] __driver_probe_device+0x78/0x170 [ 71.986221]     driver_probe_device+0x1f/0x90 [ 71.986224] __device_attach_driver+0x89/0x110 [ 71.986227] ?     driver_allows_async_probing+0x70/0x70 [ 71.986230] bus_for_each_drv+0x8c/0xe0 [ 71.986232]
    __device_attach+0xb2/0x1e0 [ 71.986235] bus_probe_device+0x92/0xb0 [ 71.986237] device_add+0x422/0x9a0 [     71.986239] ? _dev_info+0x7d/0x98 [ 71.986242] ? blake2s_update+0x4c/0xc0 [ 71.986246]     usb_new_device.cold+0x148/0x36d [ 71.986250] hub_event+0xa8a/0x1910 [ 71.986255]     process_one_work+0x1c4/0x380 [ 71.986259] worker_thread+0x51/0x390 [ 71.986262] ?     rescuer_thread+0x3b0/0x3b0 [ 71.986264] kthread+0xdb/0x110 [ 71.986266] ?     kthread_complete_and_exit+0x20/0x20 [ 71.986268] ret_from_fork+0x1f/0x30 [ 71.986273] </TASK> [ 71.986274]
    ---[ end trace 0000000000000000 ]--- [ 71.986284] btusb: probe of 2-1.6:1.0 failed with error -17     (CVE-2022-48982)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix buffer overflow in     elem comparison For vendor elements, the code here assumes that 5 octets are present without checking.
    Since the element itself is already checked to fit, we only need to check the length. (CVE-2022-49023)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
187013	SUSE SLES15 Security Update : kernel (Live Patch 27 for SLE 15 SP3) (SUSE-SU-2023:4871-1)	Nessus	SuSE Local Security Checks	2023/12/15	2026/6/25	high
187020	SUSE SLES15 Security Update : kernel (Live Patch 16 for SLE 15 SP4) (SUSE-SU-2023:4872-1)	Nessus	SuSE Local Security Checks	2023/12/15	2026/6/25	high
189666	Oracle Linux 9 : kernel (ELSA-2024-12094)	Nessus	Oracle Linux Local Security Checks	2024/1/26	2026/2/9	high
189791	RHEL 8 : kernel (RHSA-2024:0562)	Nessus	Red Hat Local Security Checks	2024/1/30	2024/11/7	high
193759	RHEL 7 : kernel-rt (RHSA-2024:2003)	Nessus	Red Hat Local Security Checks	2024/4/24	2024/11/7	critical
194405	RHEL 9 : kernel (RHSA-2024:0461)	Nessus	Red Hat Local Security Checks	2024/4/28	2025/3/6	high
189750	RHEL 8 : kpatch-patch (RHSA-2024:0554)	Nessus	Red Hat Local Security Checks	2024/1/30	2024/11/8	high
293578	MiracleLinux 7 : kernel-3.10.0-1160.118.1.el7 (AXSA:2024-7723:11)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
187870	CentOS 8 : kernel (CESA-2024:0113)	Nessus	CentOS Local Security Checks	2024/1/10	2024/1/15	high
187968	Oracle Linux 8 : kernel (ELSA-2024-12069)	Nessus	Oracle Linux Local Security Checks	2024/1/11	2026/2/9	high
330511	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2026-0063)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/29	high

检测

插件搜索

high

high

high

high

critical

high

high

critical

high

high

high