In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Wrap the tx reporter dump callback to extract the sq Function mlx5e_tx_reporter_dump_sq() casts its void * argument to struct mlx5e_txqsq *, but in TX-timeout-recovery flow the argument is actually of type struct mlx5e_tx_timeout_ctx *. mlx5_core 0000:08:00.1 enp8s0f1: TX timeout detected mlx5_core 0000:08:00.1 enp8s0f1: TX timeout on queue: 1, SQ: 0x11ec, CQ: 0x146d, SQ Cons: 0x0 SQ Prod: 0x1, usecs since last trans: 21565000 BUG: stack guard page was hit at 0000000093f1a2de (stack is 00000000b66ea0dc..000000004d932dae) kernel stack overflow (page fault): 0000 [#1] SMP NOPTI CPU: 5 PID: 95 Comm: kworker/u20:1 Tainted: G W OE 5.13.0_mlnx #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e mlx5e_tx_timeout_work [mlx5_core] RIP: 0010:mlx5e_tx_reporter_dump_sq+0xd3/0x180 [mlx5_core] Call Trace: mlx5e_tx_reporter_dump+0x43/0x1c0 [mlx5_core] devlink_health_do_dump.part.91+0x71/0xd0 devlink_health_report+0x157/0x1b0 mlx5e_reporter_tx_timeout+0xb9/0xf0 [mlx5_core] ? mlx5e_tx_reporter_err_cqe_recover+0x1d0/0x1d0 [mlx5_core] ? mlx5e_health_queue_dump+0xd0/0xd0 [mlx5_core] ? update_load_avg+0x19b/0x550 ? set_next_entity+0x72/0x80 ? pick_next_task_fair+0x227/0x340 ? finish_task_switch+0xa2/0x280 mlx5e_tx_timeout_work+0x83/0xb0 [mlx5_core] process_one_work+0x1de/0x3a0 worker_thread+0x2d/0x3c0 ? process_one_work+0x3a0/0x3a0 kthread+0x115/0x130 ? kthread_park+0x90/0x90 ret_from_fork+0x1f/0x30 --[ end trace 51ccabea504edaff ]--- RIP: 0010:mlx5e_tx_reporter_dump_sq+0xd3/0x180 PKRU: 55555554 Kernel panic - not syncing: Fatal exception Kernel Offset: disabled end Kernel panic - not syncing: Fatal exception To fix this bug add a wrapper for mlx5e_tx_reporter_dump_sq() which extracts the sq from struct mlx5e_tx_timeout_ctx and set it as the TX-timeout-recovery flow dump callback.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1490-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
    - CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
    - CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
    - CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
    - CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
    - CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
    - CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
    - CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
    - CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
    - CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
    - CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
    - CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
    - CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
    - CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
    - CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in     net/marvell/prestera (bsc#1221009).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
    - CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
    - CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
    - CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()     (bsc#1222660).
    - CVE-2021-47182: Fixed buffer length handling in scsi_mode_sense() in scsi core (bsc#1222662).
    - CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145,     bsc#1222664).
    - CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
    - CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work     functions in btrfs (bsc#1222706).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
    - CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng     (bsc#1220990).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).
    - CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
    - CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52481: Fixed speculative unprivileged load in Cortex-A520 (bsc#1220887).
    - CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
    - CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).
    - CVE-2023-52488: Fixed data corruption due to error on incrementing register address in regmap functions     for FIFO in serial sc16is7xx (bsc#1221162).
    - CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function
    __dma_async_device_channel_register() (bsc#1221276).
    - CVE-2023-52493: Fixed possible soft lockup in bus/mhi/host (bsc#1221274).
    - CVE-2023-52494: Fixed missing alignment check for event ring read pointer in bus/mhi/host (bsc#1221273).
    - CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52503: Fixed use-after-free in amdtee_close_session due to race condition with     amdtee_open_session in tee amdtee (bsc#1220915).
    - CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine     (bsc#1221553).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
    - CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
    - CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i     (bsc#1221055).
    - CVE-2023-52518: Fixed information leak in bluetooth/hci_codec (bsc#1221056).
    - CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
    - CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
    - CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2023-52561: Fixed denial of service due to missing reserved attribute on cont splash memory region     in arm64 dts qcom sdm845-db845c (bsc#1220935).
    - CVE-2023-52563: Fixed memory leak on ->hpd_notify callback() in drm/meson (bsc#1220937).
    - CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
    - CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
    - CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0)     (bsc#1220839).
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).
    - CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).
    - CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).
    - CVE-2023-52599: Fixed array-index-out-of-bounds in diNewExt() in jfs (bsc#1221062).
    - CVE-2023-52600: Fixed uaf in jfs_evict_inode() (bsc#1221071).
    - CVE-2023-52601: Fixed array-index-out-of-bounds in dbAdjTree() in jfs (bsc#1221068).
    - CVE-2023-52602: Fixed slab-out-of-bounds Read in dtSearch() in jfs (bsc#1221070).
    - CVE-2023-52603: Fixed array-index-out-of-bounds in dtSplitRoot() (bsc#1221066).
    - CVE-2023-52604: Fixed array-index-out-of-bounds in dbAdjTree() (bsc#1221067).
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52606: Fixed possible kernel stack corruption in powerpc/lib (bsc#1221069).
    - CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).
    - CVE-2023-52608: Fixed possible race condition in firmware/arm_scmi (bsc#1221375).
    - CVE-2023-52612: Fixed req->dst buffer overflow in crypto/scomp (bsc#1221616).
    - CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).
    - CVE-2023-52617: Fixed stdev_release() crash after surprise hot remove (bsc#1221613).
    - CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram     (bsc#1221618).
    - CVE-2023-52621: Fixed missing asserion in bpf (bsc#1222073).
    - CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).
    - CVE-2023-52627: Fixed null pointer dereference due to lack of callback functions in iio adc ad7091r     (bsc#1222051)
    - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).
    - CVE-2023-52632: Fixed lock dependency warning with srcu in drm/amdkfd (bsc#1222274).
    - CVE-2023-52636: Fixed denial of service due to wrongly init the cursor when preparing sparse read in     msgr2 in libceph  (bsc#1222247).
    - CVE-2023-52637: Fixed UAF in j1939_sk_match_filter() in can/k1939 (bsc#1222291).
    - CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()     (bsc#1218336).
    - CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in     net/netfilter/nf_conntrack_netlink.c (bsc#1218479).
    - CVE-2024-0841: Fixed null pointer dereference in hugetlbfs_fill_super() (bsc#1219264).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-23850: Fixed denial of service due to assertion failure due to subvolume readed before root     item insertion in btrfs_get_root_ref in btrfs (bsc#1219126).
    - CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).
    - CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2024-26599: Fixed out-of-bounds access in of_pwm_single_xlate() (bsc#1220365).
    - CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
    - CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
    - CVE-2024-26612: Fixed Oops in fscache_put_cache() This function dereferences  (bsc#1221291).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-26620: Fixed possible device model violation in s390/vfio-ap (bsc#1221298).
    - CVE-2024-26627: Fixed possible hard lockup in scsi (bsc#1221090).
    - CVE-2024-26629: Fixed possible protocol violation via RELEASE_LOCKOWNER in nfsd (bsc#1221379).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26645: Fixed missing visibility when inserting an element into tracing_map (bsc#1222056).
    - CVE-2024-26646: Fixed potential memory corruption when resuming from suspend or hibernation in     thermal/intel/hfi (bsc#1222070).
    - CVE-2024-26651: Fixed possible oops via malicious devices in sr9800 (bsc#1221337).
    - CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
    - CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).
    - CVE-2024-26660: Fixed buffer overflow in dcn301_stream_encoder_create in drm amd display (bsc#1222266)
    - CVE-2024-26664: Fixed out-of-bounds memory access in create_core_data() in hwmon coretemp (bsc#1222355).
    - CVE-2024-26667: Fixed null pointer reference in dpu_encoder_helper_phys_cleanup in drm/msm/dpu     (bsc#1222331).
    - CVE-2024-26670: Fixed ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround in kernel arm64 (bsc#1222356).
    - CVE-2024-26680: Fixed denial of service due to DMA mapping for PTP hwts ring in net atlantic     (bsc#1222427).
    - CVE-2024-26681: Fixed denial of service in nsim_dev_trap_report_work() in netdevsim (bsc#1222431).
    - CVE-2024-26684: Fixed handling of DPP safety error for DMA channels in net stmmac xgmac (bsc#1222445).
    - CVE-2024-26685: Fixed denial of service in end_buffer_async_write() in nilfs2 (bsc#1222437).
    - CVE-2024-26689: Fixed use-after-free in encode_cap_msg() in ceph (bsc#1222503).
    - CVE-2024-26695: Fixed null pointer dereference in __sev_platform_shutdown_locked in crypto ccp     (bsc#1222373).
    - CVE-2024-26696: Fixed denial of service in nilfs_lookup_dirty_data_buffers() in nilfs2 (bsc#1222549).
    - CVE-2024-26697: Fixed data corruption in dsync block recovery for small block sizes in nilfs2     (bsc#1222550).
    - CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
    - CVE-2024-26717: Fixed null pointer dereference on failed power up in HID i2c-hid-of (bsc#1222360).
    - CVE-2024-26718: Fixed memory corruption in tasklet_unlock via disabling tasklets in dm-crypt and dm-     verify (bsc#1222416).
    - CVE-2024-26722: Fixed denial of service in rt5645_jack_detect_work() due to mutex left locked forever in     ASoC rt5645 (bsc#1222520).
    - CVE-2024-26727: Fixed denial of service due to assertion failure during subvolume creation     (bsc#1222536).
    - CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
    - CVE-2024-26736: Fixed buffer overflow in afs_update_volume_status() in afs (bsc#1222586).
    - CVE-2024-26737: Fixed use-after-free due to race between bpf_timer_cancel_and_free and bpf_timer_cancel     in bpf (bsc#1222557).
    - CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677)
    - CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449)
    - CVE-2024-26745: Fixed null pointer dereference due to IOMMU table not initialized for kdump over SR-IOV     (bsc#1220492, bsc#1222678).
    - CVE-2024-26747: Fixed null pointer issue when put module's reference in usb roles  (bsc#1222609).
    - CVE-2024-26749: Fixed use-after-free at cdns3_gadget_ep_disable() in usb cdns3 (bsc#1222680).
    - CVE-2024-26751: Fixed denial of service due to gpiod_lookup_table search loop not ending correctly     (bsc#1222724)
    - CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).
    - CVE-2024-26760: Fixed null pointer dereference on error case in bio_put() in scsi target pscsi     (bsc#1222596)
    - CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt     (bsc#1222720).
    - CVE-2024-26766: Fixed off-by-one error in sdma.h tx->num_descs in ib/hfi1 (bsc#1222726)
    - CVE-2024-26769: Fixed deadlock on delete association path in nvmet-fc  (bsc#1222727).
    - CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)
    - CVE-2024-26776: Fixed null pointer dereference due to null value returned by interrupt handler in spi     hisi-sfc-v3xx (bsc#1222764)
    - CVE-2024-26779: Fixed denial of service due to race condition on enabling fast-xmit in wifi mac80211     (bsc#1222772).
    - CVE-2024-26787: Fixed DMA API overlapping mappings in mmc mmci stm32 (bsc#1222781)
    - CVE-2024-26790: Fixed denial of service on 16 bytes unaligned read in dmaengine fsl-qdma (bsc#1222784)
    - CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).
    - CVE-2024-26798: Fixed denial of service due to wrongly restore fond data upon failure in fbcon     (bsc#1222798).
    - CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).
    - CVE-2024-26807: Fixed memory corruption due to wrong pointer reference in spi cadence-qspi (bsc#1222801)
    - CVE-2024-26848: Fixed denial of service due to endless loop in directory parsing in afs (bsc#1223030).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1480-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
    - CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
    - CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
    - CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
    - CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
    - CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
    - CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
    - CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
    - CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
    - CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
    - CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
    - CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
    - CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
    - CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
    - CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
    - CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
    - CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in     net/marvell/prestera (bsc#1221009).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
    - CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
    - CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
    - CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
    - CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
    - CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng     (bsc#1220990).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).
    - CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
    - CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
    - CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
    - CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52481: Fixed speculative unprivileged load in Cortex-A520 (bsc#1220887).
    - CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
    - CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
    - CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).
    - CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function
    __dma_async_device_channel_register() (bsc#1221276).
    - CVE-2023-52493: Fixed possible soft lockup in bus/mhi/host (bsc#1221274).
    - CVE-2023-52494: Fixed missing alignment check for event ring read pointer in bus/mhi/host (bsc#1221273).
    - CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine     (bsc#1221553).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
    - CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
    - CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i     (bsc#1221055).
    - CVE-2023-52518: Fixed information leak in bluetooth/hci_codec (bsc#1221056).
    - CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
    - CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
    - CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
    - CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
    - CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
    - CVE-2023-52563: Fixed memory leak on ->hpd_notify callback() in drm/meson (bsc#1220937).
    - CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
    - CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
    - CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0)     (bsc#1220839).
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).
    - CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).
    - CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).
    - CVE-2023-52599: Fixed array-index-out-of-bounds in diNewExt() in jfs (bsc#1221062).
    - CVE-2023-52600: Fixed uaf in jfs_evict_inode() (bsc#1221071).
    - CVE-2023-52601: Fixed array-index-out-of-bounds in dbAdjTree() in jfs (bsc#1221068).
    - CVE-2023-52602: Fixed slab-out-of-bounds Read in dtSearch() in jfs (bsc#1221070).
    - CVE-2023-52603: Fixed array-index-out-of-bounds in dtSplitRoot() (bsc#1221066).
    - CVE-2023-52604: Fixed array-index-out-of-bounds in dbAdjTree() (bsc#1221067).
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52606: Fixed possible kernel stack corruption in powerpc/lib (bsc#1221069).
    - CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).
    - CVE-2023-52608: Fixed possible race condition in firmware/arm_scmi (bsc#1221375).
    - CVE-2023-52612: Fixed req->dst buffer overflow in crypto/scomp (bsc#1221616).
    - CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).
    - CVE-2023-52617: Fixed stdev_release() crash after surprise hot remove (bsc#1221613).
    - CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram     (bsc#1221618).
    - CVE-2023-52621: Fixed missing asserion in bpf (bsc#1222073).
    - CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).
    - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).
    - CVE-2023-52632: Fixed lock dependency warning with srcu in drm/amdkfd (bsc#1222274).
    - CVE-2023-52637: Fixed UAF in j1939_sk_match_filter() in can/k1939 (bsc#1222291).
    - CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).
    - CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()     (bsc#1218336).
    - CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in     net/netfilter/nf_conntrack_netlink.c (bsc#1218479).
    - CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs     (HugeTLB pages) functionality (bsc#1219264).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2024-25743: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2024-26599: Fixed out-of-bounds access in of_pwm_single_xlate() (bsc#1220365).
    - CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
    - CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
    - CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
    - CVE-2024-26612: Fixed Oops in fscache_put_cache() This function dereferences  (bsc#1221291).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-26620: Fixed possible device model violation in s390/vfio-ap (bsc#1221298).
    - CVE-2024-26627: Fixed possible hard lockup in scsi (bsc#1221090).
    - CVE-2024-26629: Fixed possible protocol violation via RELEASE_LOCKOWNER in nfsd (bsc#1221379).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26645: Fixed missing visibility when inserting an element into tracing_map (bsc#1222056).
    - CVE-2024-26646: Fixed potential memory corruption when resuming from suspend or hibernation in     thermal/intel/hfi (bsc#1222070).
    - CVE-2024-26651: Fixed possible oops via malicious devices in sr9800 (bsc#1221337).
    - CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
    - CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).
    - CVE-2024-26664: Fixed out-of-bounds memory access in create_core_data() in hwmon coretemp (bsc#1222355).
    - CVE-2024-26667: Fixed null pointer reference in dpu_encoder_helper_phys_cleanup in drm/msm/dpu     (bsc#1222331).
    - CVE-2024-26670: Fixed ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround in kernel arm64 (bsc#1222356).
    - CVE-2024-26695: Fixed null pointer dereference in __sev_platform_shutdown_locked in crypto ccp     (bsc#1222373).
    - CVE-2024-26717: Fixed null pointer dereference on failed power up in HID i2c-hid-of (bsc#1222360).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1466-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

    NOTE: This update has been retracted due to a bug in the BHI CPU sidechannel mitigation, which led to     incorrect selection of other CPU mitigations.

    The following security bugs were fixed:

    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
    - CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
    - CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
    - CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
    - CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
    - CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
    - CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
    - CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
    - CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
    - CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
    - CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
    - CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
    - CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
    - CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
    - CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
    - CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
    - CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in     net/marvell/prestera (bsc#1221009).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
    - CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
    - CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
    - CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
    - CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
    - CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng     (bsc#1220990).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).
    - CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
    - CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
    - CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
    - CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52481: Fixed speculative unprivileged load in Cortex-A520 (bsc#1220887).
    - CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
    - CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
    - CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).
    - CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function
    __dma_async_device_channel_register() (bsc#1221276).
    - CVE-2023-52493: Fixed possible soft lockup in bus/mhi/host (bsc#1221274).
    - CVE-2023-52494: Fixed missing alignment check for event ring read pointer in bus/mhi/host (bsc#1221273).
    - CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine     (bsc#1221553).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
    - CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
    - CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i     (bsc#1221055).
    - CVE-2023-52518: Fixed information leak in bluetooth/hci_codec (bsc#1221056).
    - CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
    - CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
    - CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
    - CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
    - CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
    - CVE-2023-52563: Fixed memory leak on ->hpd_notify callback() in drm/meson (bsc#1220937).
    - CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
    - CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
    - CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0)     (bsc#1220839).
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).
    - CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).
    - CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).
    - CVE-2023-52599: Fixed array-index-out-of-bounds in diNewExt() in jfs (bsc#1221062).
    - CVE-2023-52600: Fixed uaf in jfs_evict_inode() (bsc#1221071).
    - CVE-2023-52601: Fixed array-index-out-of-bounds in dbAdjTree() in jfs (bsc#1221068).
    - CVE-2023-52602: Fixed slab-out-of-bounds Read in dtSearch() in jfs (bsc#1221070).
    - CVE-2023-52603: Fixed array-index-out-of-bounds in dtSplitRoot() (bsc#1221066).
    - CVE-2023-52604: Fixed array-index-out-of-bounds in dbAdjTree() (bsc#1221067).
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52606: Fixed possible kernel stack corruption in powerpc/lib (bsc#1221069).
    - CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).
    - CVE-2023-52608: Fixed possible race condition in firmware/arm_scmi (bsc#1221375).
    - CVE-2023-52612: Fixed req->dst buffer overflow in crypto/scomp (bsc#1221616).
    - CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).
    - CVE-2023-52617: Fixed stdev_release() crash after surprise hot remove (bsc#1221613).
    - CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram     (bsc#1221618).
    - CVE-2023-52621: Fixed missing asserion in bpf (bsc#1222073).
    - CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).
    - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).
    - CVE-2023-52632: Fixed lock dependency warning with srcu in drm/amdkfd (bsc#1222274).
    - CVE-2023-52637: Fixed UAF in j1939_sk_match_filter() in can/k1939 (bsc#1222291).
    - CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).
    - CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()     (bsc#1218336).
    - CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in     net/netfilter/nf_conntrack_netlink.c (bsc#1218479).
    - CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs     (HugeTLB pages) functionality (bsc#1219264).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2024-26599: Fixed out-of-bounds access in of_pwm_single_xlate() (bsc#1220365).
    - CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
    - CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
    - CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
    - CVE-2024-26612: Fixed Oops in fscache_put_cache() This function dereferences  (bsc#1221291).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-26620: Fixed possible device model violation in s390/vfio-ap (bsc#1221298).
    - CVE-2024-26627: Fixed possible hard lockup in scsi (bsc#1221090).
    - CVE-2024-26629: Fixed possible protocol violation via RELEASE_LOCKOWNER in nfsd (bsc#1221379).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26645: Fixed missing visibility when inserting an element into tracing_map (bsc#1222056).
    - CVE-2024-26646: Fixed potential memory corruption when resuming from suspend or hibernation in     thermal/intel/hfi (bsc#1222070).
    - CVE-2024-26651: Fixed possible oops via malicious devices in sr9800 (bsc#1221337).
    - CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
    - CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).
    - CVE-2024-26664: Fixed out-of-bounds memory access in create_core_data() in hwmon coretemp (bsc#1222355).
    - CVE-2024-26667: Fixed null pointer reference in dpu_encoder_helper_phys_cleanup in drm/msm/dpu     (bsc#1222331).
    - CVE-2024-26670: Fixed ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround in kernel arm64 (bsc#1222356).
    - CVE-2024-26695: Fixed null pointer dereference in __sev_platform_shutdown_locked in crypto ccp     (bsc#1222373).
    - CVE-2024-26717: Fixed null pointer dereference on failed power up in HID i2c-hid-of (bsc#1222360).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1322-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
    - CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
    - CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
    - CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
    - CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
    - CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
    - CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
    - CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
    - CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
    - CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
    - CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
    - CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
    - CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
    - CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
    - CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
    - CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
    - CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in     net/marvell/prestera (bsc#1221009).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
    - CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
    - CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
    - CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
    - CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
    - CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng     (bsc#1220990).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).
    - CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
    - CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
    - CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
    - CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register (bsc#1220433).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52481: Fixed speculative unprivileged load in Cortex-A520 (bsc#1220887).
    - CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
    - CVE-2023-52484: Fixed a soft lockup triggered by arm_smmu_mm_invalidate_range (bsc#1220797).
    - CVE-2023-52486: Fixed possible use-after-free in drm (bsc#1221277).
    - CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function
    __dma_async_device_channel_register() (bsc#1221276).
    - CVE-2023-52493: Fixed possible soft lockup in bus/mhi/host (bsc#1221274).
    - CVE-2023-52494: Fixed missing alignment check for event ring read pointer in bus/mhi/host (bsc#1221273).
    - CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine     (bsc#1221553).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
    - CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
    - CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i     (bsc#1221055).
    - CVE-2023-52518: Fixed information leak in bluetooth/hci_codec (bsc#1221056).
    - CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
    - CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
    - CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
    - CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
    - CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2023-52559: Fixed a bug by avoiding memory allocation in iommu_suspend (bsc#1220933).
    - CVE-2023-52563: Fixed memory leak on ->hpd_notify callback() in drm/meson (bsc#1220937).
    - CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
    - CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
    - CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0)     (bsc#1220839).
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).
    - CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52587: Fixed mcast list locking in IB/ipoib (bsc#1221082).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52594: Fixed potential array-index-out-of-bounds read in ath9k_htc_txstatus() (bsc#1221045).
    - CVE-2023-52595: Fixed possible deadlock in wifi/rt2x00 (bsc#1221046).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2023-52598: Fixed wrong setting of fpc register in s390/ptrace (bsc#1221060).
    - CVE-2023-52599: Fixed array-index-out-of-bounds in diNewExt() in jfs (bsc#1221062).
    - CVE-2023-52600: Fixed uaf in jfs_evict_inode() (bsc#1221071).
    - CVE-2023-52601: Fixed array-index-out-of-bounds in dbAdjTree() in jfs (bsc#1221068).
    - CVE-2023-52602: Fixed slab-out-of-bounds Read in dtSearch() in jfs (bsc#1221070).
    - CVE-2023-52603: Fixed array-index-out-of-bounds in dtSplitRoot() (bsc#1221066).
    - CVE-2023-52604: Fixed array-index-out-of-bounds in dbAdjTree() (bsc#1221067).
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52606: Fixed possible kernel stack corruption in powerpc/lib (bsc#1221069).
    - CVE-2023-52607: Fixed a null-pointer-dereference in pgtable_cache_add kasprintf() (bsc#1221061).
    - CVE-2023-52608: Fixed possible race condition in firmware/arm_scmi (bsc#1221375).
    - CVE-2023-52612: Fixed req->dst buffer overflow in crypto/scomp (bsc#1221616).
    - CVE-2023-52615: Fixed page fault dead lock on mmap-ed hwrng (bsc#1221614).
    - CVE-2023-52617: Fixed stdev_release() crash after surprise hot remove (bsc#1221613).
    - CVE-2023-52619: Fixed possible crash when setting number of cpus to an odd number in pstore/ram     (bsc#1221618).
    - CVE-2023-52621: Fixed missing asserion in bpf (bsc#1222073).
    - CVE-2023-52623: Fixed suspicious RCU usage in SUNRPC (bsc#1222060).
    - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).
    - CVE-2023-52632: Fixed lock dependency warning with srcu in drm/amdkfd (bsc#1222274).
    - CVE-2023-52637: Fixed UAF in j1939_sk_match_filter() in can/k1939 (bsc#1222291).
    - CVE-2023-52639: Fixed race during shadow creation in KVM/s390/vsie Fixed (bsc#1222300).
    - CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()     (bsc#1218336).
    - CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in     net/netfilter/nf_conntrack_netlink.c (bsc#1218479).
    - CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs     (HugeTLB pages) functionality (bsc#1219264).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).
    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2024-26599: Fixed out-of-bounds access in of_pwm_single_xlate() (bsc#1220365).
    - CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
    - CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
    - CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
    - CVE-2024-26612: Fixed Oops in fscache_put_cache() This function dereferences  (bsc#1221291).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-26620: Fixed possible device model violation in s390/vfio-ap (bsc#1221298).
    - CVE-2024-26627: Fixed possible hard lockup in scsi (bsc#1221090).
    - CVE-2024-26629: Fixed possible protocol violation via RELEASE_LOCKOWNER in nfsd (bsc#1221379).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26645: Fixed missing visibility when inserting an element into tracing_map (bsc#1222056).
    - CVE-2024-26646: Fixed potential memory corruption when resuming from suspend or hibernation in     thermal/intel/hfi (bsc#1222070).
    - CVE-2024-26651: Fixed possible oops via malicious devices in sr9800 (bsc#1221337).
    - CVE-2024-26654: Fixed use after free in ALSA/sh/aica (bsc#1222304).
    - CVE-2024-26659: Fixed wrong handling of isoc Babble and Buffer Overrun events in xhci (bsc#1222317).
    - CVE-2024-26664: Fixed out-of-bounds memory access in create_core_data() in hwmon coretemp (bsc#1222355).
    - CVE-2024-26667: Fixed null pointer reference in dpu_encoder_helper_phys_cleanup in drm/msm/dpu     (bsc#1222331).
    - CVE-2024-26670: Fixed ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround in kernel arm64 (bsc#1222356).
    - CVE-2024-26695: Fixed null pointer dereference in __sev_platform_shutdown_locked in crypto ccp     (bsc#1222373).
    - CVE-2024-26717: Fixed null pointer dereference on failed power up in HID i2c-hid-of (bsc#1222360).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1321-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2023-52519: Fixed possible overflow in HID/intel-ish-hid/ipc (bsc#1220920).
    - CVE-2023-52529: Fixed a potential memory leak in sony_probe() (bsc#1220929).
    - CVE-2023-52474: Fixed a vulnerability with non-PAGE_SIZE-end multi-iovec user SDMA requests     (bsc#1220445).
    - CVE-2023-52513: Fixed connection failure handling  in RDMA/siw (bsc#1221022).
    - CVE-2023-52515: Fixed possible use-after-free in RDMA/srp (bsc#1221048).
    - CVE-2023-52564: Reverted invalid fix for UAF in gsm_cleanup_mux() (bsc#1220938).
    - CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround  (bsc#1220251).
    - CVE-2023-52510: Fixed a potential UAF in ca8210_probe() (bsc#1220898).
    - CVE-2023-52524: Fixed possible corruption in nfc/llcp (bsc#1220927).
    - CVE-2023-52528: Fixed uninit-value access in __smsc75xx_read_reg() (bsc#1220843).
    - CVE-2023-52507: Fixed possible shift-out-of-bounds in nfc/nci (bsc#1220833).
    - CVE-2023-52566: Fixed potential use after free in nilfs_gccache_submit_read_data() (bsc#1220940).
    - CVE-2023-52508: Fixed null pointer dereference in nvme_fc_io_getuuid() (bsc#1221015).
    - CVE-2023-6535: Fixed a NULL pointer dereference in nvmet_tcp_execute_request (bsc#1217988).
    - CVE-2023-6536: Fixed a NULL pointer dereference in __nvmet_req_complete (bsc#1217989).
    - CVE-2023-6356: Fixed a NULL pointer dereference in nvmet_tcp_build_pdu_iovec (bsc#1217987).
    - CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
    - CVE-2023-52520: Fixed reference leak in platform/x86/think-lmi (bsc#1220921).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-52509: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1220836).
    - CVE-2023-52501: Fixed possible memory corruption in ring-buffer (bsc#1220885).
    - CVE-2023-52567: Fixed possible Oops in  serial/8250_port: when using IRQ polling (irq = 0)     (bsc#1220839).
    - CVE-2023-52517: Fixed race between DMA RX transfer completion and RX FIFO drain in spi/sun6i     (bsc#1221055).
    - CVE-2023-52511: Fixed possible memory corruption in spi/sun6i (bsc#1221012).
    - CVE-2023-52525: Fixed out of bounds check mwifiex_process_rx_packet() (bsc#1220840).
    - CVE-2023-52504: Fixed possible out-of bounds in apply_alternatives() on a 5-level paging machine     (bsc#1221553).
    - CVE-2023-52575: Fixed SBPB enablement for spec_rstack_overflow=off (bsc#1220871).
    - CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
    - CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
    - CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng     (bsc#1220990).
    - CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
    - CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
    - CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
    - CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
    - CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
    - CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
    - CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
    - CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
    - CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
    - CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
    - CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
    - CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
    - CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
    - CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in     net/marvell/prestera (bsc#1221009).
    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
    - CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
    - CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could     lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
    - CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
    - CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
    - CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver     functionality (bsc#1209635).
    - CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
    - CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
    - CVE-2023-52492: Fixed a null-pointer-dereference in channel unregistration function
    __dma_async_device_channel_register() (bsc#1221276).
    - CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-52583: Fixed deadlock or deadcode of misusing dget() inside ceph (bsc#1221058).
    - CVE-2023-52582: Fixed possible oops in netfs (bsc#1220878).
    - CVE-2023-52477: Fixed USB Hub accesses to uninitialized BOS descriptors (bsc#1220790).
    - CVE-2023-52470: Fixed null-ptr-deref in radeon_crtc_init() (bsc#1220413).
    - CVE-2023-52469: Fixed a use-after-free in kv_parse_power_table (bsc#1220411).
    - CVE-2023-52576: Fixed potential use after free in memblock_isolate_range() (bsc#1220872).
    - CVE-2024-26600: Fixed NULL pointer dereference for SRP in phy-omap-usb2 (bsc#1220340).
    - CVE-2023-52497: Fixed data corruption in erofs (bsc#1220879).
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2023-52523: Fixed wrong redirects to non-TCP sockets in bpf (bsc#1220926).
    - CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.93-87.444. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-009 advisory.

    2024-11-08: CVE-2021-47550 was added to this advisory.

    2024-11-08: CVE-2021-47548 was added to this advisory.

    2024-08-01: CVE-2021-47585 was added to this advisory.

    2024-08-01: CVE-2021-47603 was added to this advisory.

    2024-08-01: CVE-2021-47609 was added to this advisory.

    2024-08-01: CVE-2021-47578 was added to this advisory.

    2024-08-01: CVE-2021-47606 was added to this advisory.

    2024-08-01: CVE-2021-47584 was added to this advisory.

    2024-08-01: CVE-2021-47579 was added to this advisory.

    2024-08-01: CVE-2021-47589 was added to this advisory.

    2024-08-01: CVE-2021-47597 was added to this advisory.

    2024-08-01: CVE-2021-47580 was added to this advisory.

    2024-08-01: CVE-2021-47593 was added to this advisory.

    2024-08-01: CVE-2021-47588 was added to this advisory.

    2024-08-01: CVE-2021-47090 was added to this advisory.

    2024-08-01: CVE-2021-47598 was added to this advisory.

    2024-08-01: CVE-2021-47576 was added to this advisory.

    2024-08-01: CVE-2021-47600 was added to this advisory.

    2024-08-01: CVE-2021-47097 was added to this advisory.

    2024-07-03: CVE-2021-47541 was added to this advisory.

    2024-04-25: CVE-2021-46936 was added to this advisory.

    2024-04-25: CVE-2021-46929 was added to this advisory.

    2024-04-25: CVE-2021-46934 was added to this advisory.

    2024-04-25: CVE-2021-46931 was added to this advisory.

    2023-10-12: CVE-2021-3923 was added to this advisory.

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28711)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28712)

    A denial of service flaw for virtual machine guests in the Linux kernel's Xen hypervisor subsystem was     found in the way users call some interrupts with high frequency from one of the guests.A local user could     use this flaw to starve the resources resulting in a denial of service. (CVE-2021-28713)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: The timeout could even never trigger if the guest manages to have only one free     slot in its RX queue ring page and the next package would require more than one free slot, which may be     the case when using GSO, XDP, or software hashing. (CVE-2021-28714)

    Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is     ready to process them. There are some measures taken for avoiding to pile up too much data, but those can     be bypassed by the guest: There is a timeout how long the client side of an interface can stop consuming     new packets before it is assumed to have stalled, but this timeout is rather long (60 seconds by default).
    Using a UDP connection on a fast interface can easily accumulate gigabytes of data in that time.
    (CVE-2021-28715)

    A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

    A flaw memory leak in the Linux kernel's eBPF for the Simulated networking device driver in the way user     uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this     flaw to get unauthorized access to some data. (CVE-2021-4135)

    A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

    An out-of-bounds write flaw was found in the Linux kernel's Aquantia AQtion Ethernet card Atlantic driver     in the way the ethernet card provides malicious input to the driver. This flaw allows a local user to     emulate the networking device and crash the system. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-43975)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: use call_rcu to free endpoint (CVE-2021-46929)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Wrap the tx reporter dump callback to extract the sq (CVE-2021-46931)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: validate user data in compat ioctl

    Wrong user data may cause warning in i2c_transfer(), ex: zero msgs.Userspace should not be able to trigger     warnings, so this patch addsvalidation checks for user data in compact ioctl to prevent reportedwarnings     (CVE-2021-46934)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix use-after-free in tw_timer_handler (CVE-2021-46936)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page() (CVE-2021-47090)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: elantech - fix stack out of bound access in elantech_change_report_id() (CVE-2021-47097)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (CVE-2021-47541)

    In the Linux kernel, the following vulnerability has been resolved:

    ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()     (CVE-2021-47548)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd/amdgpu: fix potential memleak (CVE-2021-47550)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() (CVE-2021-47576)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Don't call kcalloc() if size arg is zero (CVE-2021-47578)

    In the Linux kernel, the following vulnerability has been resolved:

    ovl: fix warning in ovl_create_real() (CVE-2021-47579)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: scsi_debug: Fix type in min_t to avoid stack OOB (CVE-2021-47580)

    In the Linux kernel, the following vulnerability has been resolved:

    iocost: Fix divide-by-zero on donation from low hweight cgroup (CVE-2021-47584)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix memory leak in __add_inode_ref() (CVE-2021-47585)

    In the Linux kernel, the following vulnerability has been resolved:

    sit: do not call ipip6_dev_free() from sit_init_net() (CVE-2021-47588)

    In the Linux kernel, the following vulnerability has been resolved:

    igbvf: fix double free in `igbvf_probe` (CVE-2021-47589)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: clear 'kern' flag from fallback sockets (CVE-2021-47593)

    In the Linux kernel, the following vulnerability has been resolved:

    inet_diag: fix kernel-infoleak for UDP sockets (CVE-2021-47597)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_cake: do not call cake_destroy() from cake_init() (CVE-2021-47598)

    In the Linux kernel, the following vulnerability has been resolved:

    dm btree remove: fix use after free in rebalance_children() (CVE-2021-47600)

    In the Linux kernel, the following vulnerability has been resolved:

    audit: improve robustness of the audit queue handling (CVE-2021-47603)

    In the Linux kernel, the following vulnerability has been resolved:

    net: netlink: af_netlink: Prevent empty skb by adding a check on len. (CVE-2021-47606)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: arm_scpi: Fix string overflow in SCPI genpd driver (CVE-2021-47609)

    A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem     Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in     case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local     user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to     legacy handling) could use this flaw to escalate their privileges on the system. (CVE-2022-0185)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195652	RHEL 7 : kernel (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
194976	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:1490-1)	Nessus	SuSE Local Security Checks	high
194886	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:1480-1)	Nessus	SuSE Local Security Checks	high
194745	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:1466-1)	Nessus	SuSE Local Security Checks	high
193454	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:1322-1)	Nessus	SuSE Local Security Checks	high
193453	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:1321-1)	Nessus	SuSE Local Security Checks	high
160451	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-009)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2021-46931

medium

Tenable Plugins

critical

high

high

high

high

high

high