In the Linux kernel, the following vulnerability has been resolved: net: hns3: do not allow call hns3_nic_net_open repeatedly hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice. The calltrace information is like below: [ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84 tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3] [ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]--- Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    vsock/virtio: free queued packets when closing socket(CVE-2021-47024)

    KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak(CVE-2021-47296)

    kernel:RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests(CVE-2021-47391)

    net: hns3: do not allow call hns3_nic_net_open repeatedly(CVE-2021-47400)

    drm/ nouveau/debugfs: fix file release memory leak(CVE-2021-47423)

    xhci: Fix command ring pointer corruption while aborting a command(CVE-2021-47434)

    net/tls: Fix flipped sign in tls_err_abort() calls(CVE-2021-47496)

    drm/ nouveau: fix off by one in BIOS boundary checking(CVE-2022-48732)

    nvme-rdma: fix possible use-after-free in transport error_recovery work(CVE-2022-48788)

    NFSD: Fix ia_size underflow(CVE-2022-48828)

    net-sysfs: add check for netdevice being present to speed_show(CVE-2022-48850)

    efi: fix NULL-deref in init error path(CVE-2022-48879)

    drm/virtio: Fix GEM handle creation UAF(CVE-2022-48899)

    netfilter: nf_queue: fix possible use-after-free(CVE-2022-48911)

    netfilter: fix use-after-free in __nf_register_net_hook()(CVE-2022-48912)

    RDMA/ib_srp: Fix a deadlock(CVE-2022-48930)

    KVM: x86/mmu: make apf token non-zero to fix bug(CVE-2022-48943)

    tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc(CVE-2023-52880)

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready()(CVE-2023-52885)

    xhci: Fix null pointer dereference when host dies(CVE-2023-52898)

    create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero     bytes, and crash, because of a missing check for ubi-leb_size.(CVE-2024-25739)

    dm-crypt: don't modify the data when using authenticated encryption(CVE-2024-26763)

    net/ipv6: avoid possible UAF in ip6_route_mpath_notify()(CVE-2024-26852)

    inet: inet_defrag: prevent sk release while still in use(CVE-2024-26921)

    drm/client: Fully protect modes[] with dev-mode_config.mutex(CVE-2024-35950)

    netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()(CVE-2024-36286)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    HID: core: remove unnecessary WARN_ON() in implement()(CVE-2024-39509)

    xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()(CVE-2024-40959)

    scsi: qedi: Fix crash while reading debugfs attribute(CVE-2024-40978)

    filelock: Remove locks reliably when fcntl/close race is detected(CVE-2024-41012)

    xfs: add bounds checking to xlog_recover_process_data(CVE-2024-41014)

    filelock: Fix fcntl/close race recovery compat path(CVE-2024-41020)

    USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor(CVE-2024-41035)

    ppp: reject claimed-as-LCP but actually malformed packets(CVE-2024-41044)

    ata: libata-core: Fix double free on error(CVE-2024-41087)

    drm/ nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes(CVE-2024-41095)

    netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers(CVE-2024-42070)

    ftruncate: pass a signed offset(CVE-2024-42084)

    pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER(CVE-2024-42090)

    Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again'(CVE-2024-42102)

    inet_diag: Initialize pad field in struct inet_diag_req_v2(CVE-2024-42106)

    mm: avoid overflows in dirty throttling logic(CVE-2024-42131)

    IB/core: Implement a limit on UMAD receive List(CVE-2024-42145)

    bnx2x: Fix multiple UBSAN array-index-out-of-bounds(CVE-2024-42148)

    tcp_metrics: validate source addr length(CVE-2024-42154)

    libceph: fix race between delayed_work() and ceph_monc_stop()(CVE-2024-42232)

    USB: serial: mos7840: fix crash on resume(CVE-2024-42244)

    protect the fetch of -fd[fd] in do_dup2() from mispredictions(CVE-2024-42265)

    RDMA/iwcm: Fix a use-after-free related to destroying CM IDs(CVE-2024-42285)

    scsi: qla2xxx: validate nvme_local_port correctly(CVE-2024-42286)

    scsi: qla2xxx: During vport delete send async logout explicitly(CVE-2024-42289)

    kobject_uevent: Fix OOB access within zap_modalias_env()(CVE-2024-42292)

    ext4: make sure the first directory block is not a hole(CVE-2024-42304)

    ext4: check dot and dotdot of dx_root before making dir indexed(CVE-2024-42305)

    sysctl: always initialize i_uid/i_gid(CVE-2024-42312)

    leds: trigger: Unregister sysfs attributes before calling deactivate()(CVE-2024-43830)

    cgroup/cpuset: Prevent UAF in proc_cpuset_show()(CVE-2024-43853)

    dma: fix call order in dmam_free_coherent(CVE-2024-43856)

    net: usb: qmi_wwan: fix memory leak for not ip packets(CVE-2024-43861)

    devres: Fix memory leakage caused by driver API devm_free_percpu()(CVE-2024-43871)

    exec: Fix ToCToU between perm check and set-uid/gid usage(CVE-2024-43882)

    tracing: Fix overflow in get_free_elt()(CVE-2024-43890)

    memcg: protect concurrent access to mem_cgroup_idr(CVE-2024-43892)

    serial: core: check uartclk for zero to avoid divide by zero(CVE-2024-43893)

    md/raid5: avoid BUG_ON() while continue reshape after reassembling(CVE-2024-43914)

    netfilter: ctnetlink: use helper function to calculate expect ID(CVE-2024-44944)

    ipv6: prevent UAF in ip6_send_skb()(CVE-2024-44987)

    xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration(CVE-2024-45006)

    sch/ netem: fix use after free in netem_dequeue(CVE-2024-46800)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    scsi: qedi: Fix crash while reading debugfs attribute(CVE-2024-40978)

    drm/ nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes(CVE-2024-41095)

    drm/ nouveau/debugfs: fix file release memory leak(CVE-2021-47423)

    USB: serial: mos7840: fix crash on resume(CVE-2024-42244)

    NFSD: Fix ia_size underflow(CVE-2022-48828)

    xhci: Fix command ring pointer corruption while aborting a command(CVE-2021-47434)

    ata: libata-core: Fix double free on error(CVE-2024-41087)

    xfs: add bounds checking to xlog_recover_process_data(CVE-2024-41014)

    ftruncate: pass a signed offset(CVE-2024-42084)

    ext4: check dot and dotdot of dx_root before making dir indexed(CVE-2024-42305)

    ext4: make sure the first directory block is not a hole(CVE-2024-42304)

    leds: trigger: Unregister sysfs attributes before calling deactivate()(CVE-2024-43830)

    Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again'(CVE-2024-42102)

    filelock: Remove locks reliably when fcntl/close race is detected(CVE-2024-41012)

    filelock: Fix fcntl/close race recovery compat path(CVE-2024-41020)

    protect the fetch of -fd[fd] in do_dup2() from mispredictions(CVE-2024-42265)

    scsi: qla2xxx: During vport delete send async logout explicitly(CVE-2024-42289)

    exec: Fix ToCToU between perm check and set-uid/gid usage(CVE-2024-43882)

    tracing: Fix overflow in get_free_elt()(CVE-2024-43890)

    USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor(CVE-2024-41035)

    xhci: Fix null pointer dereference when host dies(CVE-2023-52898)

    mm: avoid overflows in dirty throttling logic(CVE-2024-42131)

    kobject_uevent: Fix OOB access within zap_modalias_env()(CVE-2024-42292)

    sysctl: always initialize i_uid/i_gid(CVE-2024-42312)

    scsi: qla2xxx: validate nvme_local_port correctly(CVE-2024-42286)

    serial: core: check uartclk for zero to avoid divide by zero(CVE-2024-43893)

    tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc(CVE-2023-52880)

    memcg: protect concurrent access to mem_cgroup_idr(CVE-2024-43892)

    dma: fix call order in dmam_free_coherent(CVE-2024-43856)

    drm/ nouveau: fix off by one in BIOS boundary checking(CVE-2022-48732)

    IB/core: Implement a limit on UMAD receive List(CVE-2024-42145)

    drm/virtio: Fix GEM handle creation UAF(CVE-2022-48899)

    cgroup/cpuset: Prevent UAF in proc_cpuset_show()(CVE-2024-43853)

    net: usb: qmi_wwan: fix memory leak for not ip packets(CVE-2024-43861)

    md/raid5: avoid BUG_ON() while continue reshape after reassembling(CVE-2024-43914)

    netfilter: ctnetlink: use helper function to calculate expect ID(CVE-2024-44944)

    RDMA/iwcm: Fix a use-after-free related to destroying CM IDs(CVE-2024-42285)

    KVM: x86/mmu: make apf token non-zero to fix bug(CVE-2022-48943)

    efi: fix NULL-deref in init error path(CVE-2022-48879)

    nvme-rdma: fix possible use-after-free in transport error_recovery work(CVE-2022-48788)

    devres: Fix memory leakage caused by driver API devm_free_percpu()(CVE-2024-43871)

    netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers(CVE-2024-42070)

    xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()(CVE-2024-40959)

    xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration(CVE-2024-45006)

    tcp_metrics: validate source addr length(CVE-2024-42154)

    inet: inet_defrag: prevent sk release while still in use(CVE-2024-26921)

    net: hns3: do not allow call hns3_nic_net_open repeatedly(CVE-2021-47400)

    net/ipv6: avoid possible UAF in ip6_route_mpath_notify()(CVE-2024-26852)

    ipv6: prevent UAF in ip6_send_skb()(CVE-2024-44987)

    sch/ netem: fix use after free in netem_dequeue(CVE-2024-46800)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4349 advisory.

    * kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801)

    * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)

    * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)

    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

    * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870)

    * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)

    * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400)

    Bug Fix(es):

    * cifs - kernel panic with cifs_put_smb_ses (JIRA:Rocky Linux-28943)

    * BUG: unable to handle page fault for address: ff16bf752f593ff8 [rhel-9.4.z] (JIRA:Rocky Linux-35672)

    * [HPE 9.4 Bug] Request merge of AMD address translation library patch series [rhel-9.4.z] (JIRA:Rocky     Linux-36220)

    * [Rocky Linux9] kernel BUG at lib/list_debug.c:51! [rhel-9.4.z] (JIRA:Rocky Linux-36687)

    * ice: DPLL-related fixes [rhel-9.4.z] (JIRA:Rocky Linux-36716)

    * CNB95: net/sched: update TC core to upstream v6.8 [rhel-9.4.z] (JIRA:Rocky Linux-37641)

    * IPv6: SR: backport fixes from upstream [rhel-9.4.z] (JIRA:Rocky Linux-37669)

    * [RFE] Backport tmpfs noswap mount option [rhel-9.4.z] (JIRA:Rocky Linux-38252)

    * Isolated cores causing issues on latest Rocky Linux9.4 kernel and not functioning as desired.
    [rhel-9.4.z] (JIRA:Rocky Linux-38595)

    * [ice] Add automatic VF reset on Tx MDD events [rhel-9.4.z] (JIRA:Rocky Linux-39083)

    * [HPEMC Rocky Linux 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [rhel-9.4.z] (JIRA:Rocky     Linux-34953)

    * bnx2x: fix crashes in PCI error handling, resource leaks [rhel-9.4.z] (JIRA:Rocky Linux-43272)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4349 advisory.

    - xen-netfront: Add missing skb_mark_for_recycle (Vitaly Kuznetsov) [RHEL-37626 RHEL-36573]     {CVE-2024-27393}
    - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-38972 RHEL-37093]     {CVE-2023-52667}
    - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-38546 RHEL-35816]     {CVE-2024-26974}
    - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-38546 RHEL-35816]     {CVE-2024-26974}
    - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-34050     RHEL-30492] {CVE-2023-52626}
    - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-33913 RHEL-31828]     {CVE-2024-26801}
    - net: hns3: do not allow call hns3_nic_net_open repeatedly (Jose Ignacio Tornos Martinez) [RHEL-38933     RHEL-37707] {CVE-2021-47400}
    - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-38954 RHEL-37422] {CVE-2024-35960}
    - smb: client: fix UAF in smb2_reconnect_server() (Jay Shin) [RHEL-28943 RHEL-40177 RHEL-37273 RHEL-7986]     {CVE-2024-35870}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4349 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801)

    * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)

    * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)

    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

    * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870)

    * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)

    * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400)

    Bug Fix(es):

    * cifs - kernel panic with cifs_put_smb_ses (JIRA:RHEL-28943)

    * BUG: unable to handle page fault for address: ff16bf752f593ff8 [rhel-9.4.z] (JIRA:RHEL-35672)

    * [HPE 9.4 Bug] Request merge of AMD address translation library patch series [rhel-9.4.z]     (JIRA:RHEL-36220)

    * [RHEL9] kernel BUG at lib/list_debug.c:51! [rhel-9.4.z] (JIRA:RHEL-36687)

    * ice: DPLL-related fixes [rhel-9.4.z] (JIRA:RHEL-36716)

    * CNB95: net/sched: update TC core to upstream v6.8 [rhel-9.4.z] (JIRA:RHEL-37641)

    * IPv6: SR: backport fixes from upstream [rhel-9.4.z] (JIRA:RHEL-37669)

    * [RFE] Backport tmpfs noswap mount option [rhel-9.4.z] (JIRA:RHEL-38252)

    * Isolated cores causing issues on latest RHEL9.4 kernel and not functioning as desired. [rhel-9.4.z]     (JIRA:RHEL-38595)

    * [ice] Add automatic VF reset on Tx MDD events [rhel-9.4.z] (JIRA:RHEL-39083)

    * [HPEMC RHEL 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [rhel-9.4.z] (JIRA:RHEL-34953)

    * bnx2x: fix crashes in PCI error handling, resource leaks [rhel-9.4.z] (JIRA:RHEL-43272)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2189-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
    - CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
    - CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).
    - CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
    - CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
    - CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4106 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

    * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)

    * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403)

    * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870)

    * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)

    * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958)

    * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400)

    * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4108 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

    * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393)

    * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403)

    * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870)

    * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)

    * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958)

    * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400)

    * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957)

    Bug Fix(es):

    * lpfc updates for rh9.4 - (14.2.0.15 14.2.0.16 patches) (JIRA:RHEL-35144)

    * cifs - kernel panic with cifs_put_smb_ses (JIRA:RHEL-25787)

    * Rhel-9.2- observed vas: Failed reconfig VAS capabilities with DLPAR  message while running proc add     rem mix operations in shared mode[5.14.0-252.el9.ppc64le][P9] (JIRA:RHEL-34086)

    * CNB95: dpll: rebase DPLL to upstream v6.8 (JIRA:RHEL-36570)

    * Boot process stalls during initial loading of RHEL9.2 between the 59th and 100th AC cycle     (JIRA:RHEL-36681)

    * ice: DPLL-related fixes (JIRA:RHEL-36714)

    * [HPE RHEL 9.2 BUG] x86/platform/uv: UV support for sub-NUMA clustering (JIRA:RHEL-37595)

    * CNB95: net/sched: update TC core to upstream v6.8 (JIRA:RHEL-37640)

    * [ice] Entering Safe Mode because DDP package could not be loaded and hit panic then (JIRA:RHEL-38906)

    * [ice] Add automatic VF reset on Tx MDD events (JIRA:RHEL-39082)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2190-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
    - CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
    - CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).
    - CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).
    - CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (bsc#1224621)
    - CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)
    - CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs     (bsc#1225097).
    - CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
    - CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on     (bsc#1218447).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).
    - CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
    - CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated     (bsc#1222464).
    - CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
    - CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).
    - CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
    - CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'     (bsc#1223823).
    - CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
    - CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)
    - CVE-2024-27431: Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
    - CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).
    - CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
    - CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).
    - CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).
    - CVE-2024-35860: Struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).
    - CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).
    - CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765,).
    - CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).
    - CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).
    - CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).
    - CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224020,  bsc#1224672).
    - CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).
    - CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).
    - CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
    - CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
    - CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).
    - CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).
    - CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
    - CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
    - CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
    - CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).
    - CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
    - CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).
    - CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).
    - CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2184-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets     (bsc#1220513).
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
    - CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
    - CVE-2021-47206: Check return value after calling  platform_get_resource() (bsc#1222894).
    - CVE-2021-47238: Fixed memory leak in ip_mc_add1_src  (bsc#1224847)
    - CVE-2021-47245: Fixed out of bounds when parsing TCP options  (bsc#1224838)
    - CVE-2021-47246: Fixed page reclaim for dead peer hairpin  (CVE-2021-47246 bsc#1224831).
    - CVE-2021-47249: Fixed memory leak in rds_recvmsg  (bsc#1224880)
    - CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std  (bsc#1224827)
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot  accesses (bsc#1224960).
    - CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2021-47334: Fixed two use after free in ibmasm_init_one  (bsc#1225112).
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup()  (bsc#1225141).
    - CVE-2021-47357: Fixed possible use-after-free in ia_module_exit()  (bsc#1225144).
    - CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb  (bsc#1225082)
    - CVE-2021-47401: Fixed stack information leak (bsc#1225242).
    - CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
    - CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
    - CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit()  (bsc#1224907).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes()  (CVE-2022-48672 bsc#1223931).
    - CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
    - CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
    - CVE-2022-48702: Fixed out of bounds access in  snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
    - CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (bsc#1224621)
    - CVE-2023-52730: Fixed possible resource leaks in some error paths  (bsc#1224956).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace  (bsc#1225222).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
    - CVE-2023-52864: Fixed opening of char device (bsc#1225132).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data  (bsc#1225086).
    - CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data  (bsc#1225096).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-26625: Call sock_orphan() at release time  (bsc#1221086)
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26846: Do not wait in vain when unloading module  (bsc#1223023).
    - CVE-2024-26874: Fixed a null pointer crash in (bsc#1223048)
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26957: Fixed reference counting on zcrypt card objects  (bsc#1223666).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-26984: Fixed instmem race condition around ptr stores (bsc#1223633)
    - CVE-2024-26996: Fixed UAF ncm object at re-bind after usb  ep transport error (bsc#1223752).
    - CVE-2024-27008: Fixed out of bounds access (CVE-2024-27008 bsc#1223802).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)
    - CVE-2024-27436: Stop parsing channels bits when all channels  are found (bsc#1224803).
    - CVE-2024-35789: Check fast rx for non-4addr sta VLAN  changes (bsc#1224749).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal  (bsc#1224738).
    - CVE-2024-35830: Register v4l2 async device only after  successful setup (bsc#1224680).
    - CVE-2024-35849: Fixed information leak in btrfs_ioctl_logical_to_ino()  (bsc#1224733).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2024-35887: Fixed use-after-free bugs caused by ax25_ds_del_timer  (bsc#1224663)
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT  (bsc#1224566)
    - CVE-2024-36029: Prevent access to suspended controller (bsc#1225708)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2019-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).
    - CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).
    - CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).
    - CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
    - CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).
    - CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).
    - CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).
    - CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).
    - CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
    - CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated     (bsc#1222464).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (CVE-2023-52698 bsc#1224621)
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs     (bsc#1225097).
    - CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).
    - CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).
    - CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
    - CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
    - CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
    - CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
    - CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)
    - CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).
    - CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).
    - CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).
    - CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).
    - CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
    - CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
    - CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).
    - CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
    - CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).
    - CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).
    - CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
    - CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).
    - CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).
    - CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).
    - CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).
    - CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).
    - CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).
    - CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).
    - CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
    - CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
    - CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2008-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
    - CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
    - CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).
    - CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).
    - CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (CVE-2023-52698 bsc#1224621)
    - CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)
    - CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs     (bsc#1225097).
    - CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).
    - CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
    - CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated     (bsc#1222464).
    - CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).
    - CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'     (bsc#1223823).
    - CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)
    - CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
    - CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).
    - CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).
    - CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).
    - CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).
    - CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).
    - CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).
    - CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).
    - CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).
    - CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).
    - CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
    - CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).
    - CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).
    - CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
    - CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
    - CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).
    - CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).
    - CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
    - CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
    - CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
    - CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).
    - CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
    - CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).
    - CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).
    - CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1983-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2022-48697: Fix a use-after-free (bsc#1223922).
    - CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
    - CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
    - CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47423: Fix file release memory leak (bsc#1225366).
    - CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
    - CVE-2021-47401: Fix stack information leak (bsc#1225242).
    - CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
    - CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2023-52864: Fix opening of char device (bsc#1225132).
    - CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
    - CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
    - CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
    - CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
    - CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
    - CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)
    - CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).
    - CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).
    - CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2024-35789: Clear fast rx for non-4addr sta VLAN changes (bsc#1224749).
    - CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).
    - CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).
    - CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bzg#1224663)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
    - CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).
    - CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26996: Fix UAF ncm object at re-bind after usb ep transport error (bsc#1223752).
    - CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)
    - CVE-2022-48702: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
    - CVE-2022-48672: Fix off-by-one error in unflatten_dt_nodes() (bsc#1223931).
    - CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
    - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets     (bsc#1220513).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-27008: Fix out of bounds access (bsc#1223802).
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1979-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it
    - CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
    - CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47423: Fix file release memory leak (bsc#1225366).
    - CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960,     CVE-2021-47277).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
    - CVE-2021-47401: Fix stack information leak (bsc#1225242).
    - CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
    - CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2023-52864: Fix opening of char device (bsc#1225132).
    - CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
    - CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
    - CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
    - CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
    - CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
    - CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)
    - CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).
    - CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).
    - CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2024-35789: Clear fast rx for non-4addr in VLAN netdev (bsc#1224749).
    - CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).
    - CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).
    - CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bsc#1224663)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
    - CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).
    - CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26996: Fix UAF ncm object at re-bind after usb transport error (bsc#1223752).
    - CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210696	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2024-2815)	Nessus	Huawei Local Security Checks	high
210643	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2024-2888)	Nessus	Huawei Local Security Checks	high
202389	Rocky Linux 9 : kernel (RLSA-2024:4349)	Nessus	Rocky Linux Local Security Checks	critical
201990	Oracle Linux 9 : kernel (ELSA-2024-4349)	Nessus	Oracle Linux Local Security Checks	critical
201945	RHEL 9 : kernel (RHSA-2024:4349)	Nessus	Red Hat Local Security Checks	critical
201035	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2189-1)	Nessus	SuSE Local Security Checks	critical
201022	RHEL 9 : kernel-rt (RHSA-2024:4106)	Nessus	Red Hat Local Security Checks	critical
201020	RHEL 9 : kernel (RHSA-2024:4108)	Nessus	Red Hat Local Security Checks	critical
201009	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2190-1)	Nessus	SuSE Local Security Checks	critical
200931	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2024:2184-1)	Nessus	SuSE Local Security Checks	high
200508	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2019-1)	Nessus	SuSE Local Security Checks	critical
200462	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2008-1)	Nessus	SuSE Local Security Checks	critical
200410	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1983-1)	Nessus	SuSE Local Security Checks	high
200401	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1979-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-47400

medium

Tenable Plugins

high

high

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

high

high