In the Linux kernel, the following vulnerability has been resolved: drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper. This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero."

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2185-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47402: Protect fl_walk() with rcu (bsc#1225301)
    - CVE-2022-48673: kABI workarounds for struct smc_link (bsc#1223934).
    - CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
    - CVE-2021-47261: Fix initializing CQ fragments buffer (bsc#1224954)
    - CVE-2021-47254: Fix use-after-free in gfs2_glock_shrink_scan (bsc#1224888).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-4244: Fixed a use-after-free in the nf_tables component, which could be exploited to achieve     local privilege escalation (bsc#1215420).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-52686: Fix a null pointer in opal_event_init() (bsc#1065729).

    The following non-security bugs were fixed:

    - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
    - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
    - btrfs: do not start relocation until in progress drops are done (bsc#1222251).
    - btrfs: do not start relocation until in progress drops are done (bsc#1222251).
    - cifs: add missing spinlock around tcon refcount (bsc#1213476).
    - cifs: avoid dup prefix path in dfs_get_automount_devname() (bsc#1213476).
    - cifs: avoid race conditions with parallel reconnects (bsc#1213476).
    - cifs: avoid re-lookups in dfs_cache_find() (bsc#1213476).
    - cifs: avoid use of global locks for high contention data (bsc#1213476).
    - cifs: check only tcon status on tcon related functions (bsc#1213476).
    - cifs: do all necessary checks for credits within or before locking (bsc#1213476).
    - cifs: do not block in dfs_cache_noreq_update_tgthint() (bsc#1213476).
    - cifs: do not refresh cached referrals from unactive mounts (bsc#1213476).
    - cifs: do not take exclusive lock for updating target hints (bsc#1213476).
    - cifs: fix confusing debug message (bsc#1213476).
    - cifs: fix missing unload_nls() in smb2_reconnect() (bsc#1213476).
    - cifs: fix potential deadlock in cache_refresh_path() (bsc#1213476).
    - cifs: fix refresh of cached referrals (bsc#1213476).
    - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (bsc#1213476).
    - cifs: fix source pathname comparison of dfs supers (bsc#1213476).
    - cifs: fix status checks in cifs_tree_connect (bsc#1213476).
    - cifs: fix use-after-free bug in refresh_cache_worker() (bsc#1213476).
    - cifs: get rid of dns resolve worker (bsc#1213476).
    - cifs: get rid of mount options string parsing (bsc#1213476).
    - cifs: handle cache lookup errors different than -ENOENT (bsc#1213476).
    - cifs: ignore ipc reconnect failures during dfs failover (bsc#1213476).
    - cifs: match even the scope id for ipv6 addresses (bsc#1213476).
    - cifs: optimize reconnect of nested links (bsc#1213476).
    - cifs: prevent data race in smb2_reconnect() (bsc#1213476).
    - cifs: refresh root referrals (bsc#1213476).
    - cifs: remove duplicate code in __refresh_tcon() (bsc#1213476).
    - cifs: remove unused function (bsc#1213476).
    - cifs: remove unused smb3_fs_context::mount_options (bsc#1213476).
    - cifs: return DFS root session id in DebugData (bsc#1213476).
    - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (bsc#1213476).
    - cifs: set correct ipc status after initial tree connect (bsc#1213476).
    - cifs: set correct status of tcon ipc when reconnecting (bsc#1213476).
    - cifs: set correct tcon status after initial tree connect (bsc#1213476).
    - cifs: set DFS root session in cifs_get_smb_ses() (bsc#1213476).
    - cifs: set resolved ip in sockaddr (bsc#1213476).
    - cifs: share dfs connections and supers (bsc#1213476).
    - cifs: split out ses and tcon retrieval from mount_get_conns() (bsc#1213476).
    - cifs: use fs_context for automounts (bsc#1213476).
    - cifs: use origin fullpath for automounts (bsc#1213476).
    - cifs: use tcon allocation functions even for dummy tcon (bsc#1213476).
    - netfilter: nf_tables: defer gc run if previous batch is still pending (git-fixes).
    - netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path (git-fixes).
    - netfilter: nf_tables: fix kdoc warnings after gc rework (git-fixes).
    - netfilter: nf_tables: fix memleak when more than 255 elements expired (git-fixes).
    - netfilter: nf_tables: GC transaction race with abort path (git-fixes).
    - netfilter: nf_tables: GC transaction race with netns dismantle (git-fixes).
    - netfilter: nf_tables: mark newset as dead on transaction abort (git-fixes).
    - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (git-fixes).
    - netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure (git-fixes).
    - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (git-fixes).
    - netfilter: nf_tables: skip dead set elements in netlink dump (git-fixes).
    - netfilter: nf_tables: use correct lock to protect gc_list (git-fixes).
    - netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration (git-fixes).
    - netfilter: nft_set_rbtree: Add missing expired checks (git-fixes).
    - netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets (git-fixes).
    - netfilter: nft_set_rbtree: Detect partial overlap with start endpoint match (git-fixes).
    - netfilter: nft_set_rbtree: Detect partial overlaps on insertion (git-fixes).
    - netfilter: nft_set_rbtree: Do not account for expired elements on insertion (git-fixes).
    - netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (git-fixes).
    - netfilter: nft_set_rbtree: fix null deref on element insertion (git-fixes).
    - netfilter: nft_set_rbtree: fix overlap expiration walk (git-fixes).
    - netfilter: nft_set_rbtree: Handle outcomes of tree rotations in overlap detection (git-fixes).
    - netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (git-fixes).
    - netfilter: nft_set_rbtree: overlap detection with element re-addition after deletion (git-fixes).
    - netfilter: nft_set_rbtree: skip elements in transaction from garbage collection (git-fixes).
    - netfilter: nft_set_rbtree: skip end interval element from gc (git-fixes).
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction (git-fixes).
    - netfilter: nft_set_rbtree: Switch to node list walk for overlap detection (git-fixes).
    - netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention (git-fixes).
    - NFC: nxp: add NXP1002 (bsc#1185589).
    - PCI: rpaphp: Add MODULE_DESCRIPTION (bsc#1176869 ltc#188243).
    - smb: client: fix dfs link mount against w2k8 (git-fixes).
    - smb: client: fix null auth (bsc#1213476).
    - smb: client: set correct id, uid and cruid for multiuser automounts (git-fixes).
    - x86/xen: Drop USERGS_SYSRET64 paravirt call (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1641-1 advisory.

    The SUSE Linux Enterprise 15 SP4 LTSS kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).
    - CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).
    - CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).
    - CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found()     (bsc#1222618).
    - CVE-2024-26766: Fixed SDMA off-by-one error in _pad_sdma_tx_descs() (bsc#1222726).
    - CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).
    - CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).
    - CVE-2024-26727: Fixed assertion if a newly created btrfs subvolume already gets read (bsc#1222536).
    - CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).
    - CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).
    - CVE-2024-26687: Fixed xen/events close evtchn after mapping cleanup (bsc#1222435).
    - CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).
    - CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).
    - CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).
    - CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).
    - CVE-2024-25742: Fixed insufficient validation during #VC instruction emulation in x86/sev (bsc#1221725).
    - CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).
    - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5     modules (bsc#1219169).
    - CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).
    - CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs     (HugeTLB pages) functionality (bsc#1219264).
    - CVE-2023-7192: Fixed a memory leak problem in ctnetlink_create_conntrack in     net/netfilter/nf_conntrack_netlink.c (bsc#1218479).
    - CVE-2023-7042: Fixed a null-pointer-dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()     (bsc#1218336).
    - CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).
    - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables (bsc#1222117).
    - CVE-2023-52616: Fixed unexpected pointer access in crypto/lib/mpi in mpi_ec_init (bsc#1221612).
    - CVE-2023-52607: Fixed NULL pointer dereference in pgtable_cache_add kasprintf() (bsc#1221061).
    - CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).
    - CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).
    - CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command     (bsc#1220883).
    - CVE-2023-52476: Fixed possible unhandled page fault via perf sampling NMI during vsyscall (bsc#1220703).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system     (bsc#1209657).
    - CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223505).
    - CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb->mac_header (bsc#1223513).
    - CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions (bsc#1222878)
    - CVE-2021-47195: Fixed use-after-free inside SPI via add_lock mutex (bsc#1222832).
    - CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work     functions in btrfs (bsc#1222706).
    - CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
    - CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145,     bsc#1222664).
    - CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).
    - CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()     (bsc#1222660).

    The following non-security bugs were fixed:

    - Call flush_delayed_fput() from nfsd main-loop (bsc#1223380).
    - ibmvfc: make 'max_sectors' a module option (bsc#1216223).
    - scsi: Update max_hw_sectors on rescan (bsc#1216223).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200930	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2185-1)	Nessus	SuSE Local Security Checks	critical
200462	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2008-1)	Nessus	SuSE Local Security Checks	critical
197174	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:1659-1)	Nessus	SuSE Local Security Checks	high
197056	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:1644-1)	Nessus	SuSE Local Security Checks	high
197051	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:1641-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-47200

medium

Tenable Plugins

critical

critical

high

high

high