A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6014-1 advisory.

    Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux     kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of     service (connection termination) or inject forged data. (CVE-2020-36516)

    Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira     Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient     in some situations. A local attacker could possibly use this to expose sensitive information.
    (CVE-2021-26401)

    Jrgen Gro discovered that the Xen subsystem within the Linux kernel did not adequately limit the     number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a     driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28711,     CVE-2021-28712, CVE-2021-28713)

    Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an     integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious     ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

    It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly     handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private     clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

    It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs     in some situations. A remote attacker could possibly use this to cause a denial of service (connection     disassociation). (CVE-2021-3772)

    It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle     locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel     deadlock). (CVE-2021-4149)

    Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when     handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2021-4203)

    It was discovered that the file system quotas implementation in the Linux kernel did not properly validate     the quota block number. An attacker could use this to construct a malicious file system image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

    Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device     removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-0487)

    It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in     some situations. A privileged local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-0494)

    It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference     a null pointer in some situations. An attacker could use this to construct a malicious UDF image that,     when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

    David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some     situations. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2022-1016)

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the tty subsystem in the Linux kernel contained a race condition in certain     situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to     cause a denial of service (system crash) or expose sensitive information. (CVE-2022-1462)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-     free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-1974)

    Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context     switches from occurring during certain atomic context operations. A privileged local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1975)

    It was discovered that the HID subsystem in the Linux kernel did not properly validate inputs in certain     conditions. A local attacker with physical access could plug in a specially crafted USB device to expose     sensitive information. (CVE-2022-20132)

    It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly     verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20572, CVE-2022-2503)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel     incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this     to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

    Lucas Leong discovered that the LightNVM subsystem in the Linux kernel did not properly handle data     lengths in certain situations. A privileged attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-2991)

    It was discovered that the Intel 740 frame buffer driver in the Linux kernel contained a divide by zero     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-3061)

    Jiasheng Jiang discovered that the wm8350 charger driver in the Linux kernel did not properly deallocate     memory, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash). (CVE-2022-3111)

    It was discovered that the sound subsystem in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. An attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2022-3646)

    It was discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a     reference counting error. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36879)

    It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A     local attacker with physical access could plug in a specially crafted USB device to cause a denial of     service (memory exhaustion). (CVE-2022-3903)

    Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain     situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-39188)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset     events. A local attacker with physical access could plug in a specially crafted USB device to cause a     denial of service (kernel deadlock). (CVE-2022-4662)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data     structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a     denial of service (system crash). (CVE-2023-1095)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6001-1 advisory.

    Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux     kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of     service (connection termination) or inject forged data. (CVE-2020-36516)

    Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira     Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient     in some situations. A local attacker could possibly use this to expose sensitive information.
    (CVE-2021-26401)

    Jrgen Gro discovered that the Xen subsystem within the Linux kernel did not adequately limit the     number of events driver domains (unprivileged PV backends) could send to other guest VMs. An attacker in a     driver domain could use this to cause a denial of service in other guest VMs. (CVE-2021-28712,     CVE-2021-28713)

    Wolfgang Frisch discovered that the ext4 file system implementation in the Linux kernel contained an     integer overflow when handling metadata inode extents. An attacker could use this to construct a malicious     ext4 file system image that, when mounted, could cause a denial of service (system crash). (CVE-2021-3428)

    It was discovered that the IEEE 802.15.4 wireless network subsystem in the Linux kernel did not properly     handle certain error conditions, leading to a null pointer dereference vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2021-3659)

    It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large     shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2021-3669)

    Alois Wohlschlager discovered that the overlay file system in the Linux kernel did not restrict private     clones in some situations. An attacker could use this to expose sensitive information. (CVE-2021-3732)

    It was discovered that the SCTP protocol implementation in the Linux kernel did not properly verify VTAGs     in some situations. A remote attacker could possibly use this to cause a denial of service (connection     disassociation). (CVE-2021-3772)

    It was discovered that the btrfs file system implementation in the Linux kernel did not properly handle     locking in certain error conditions. A local attacker could use this to cause a denial of service (kernel     deadlock). (CVE-2021-4149)

    Jann Horn discovered that the socket subsystem in the Linux kernel contained a race condition when     handling listen() and connect() operations, leading to a read-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly expose sensitive information.
    (CVE-2021-4203)

    It was discovered that the file system quotas implementation in the Linux kernel did not properly validate     the quota block number. An attacker could use this to construct a malicious file system image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2021-45868)

    Zhihua Yao discovered that the MOXART SD/MMC driver in the Linux kernel did not properly handle device     removal, leading to a use-after-free vulnerability. A physically proximate attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-0487)

    It was discovered that the block layer subsystem in the Linux kernel did not properly initialize memory in     some situations. A privileged local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-0494)

    It was discovered that the UDF file system implementation in the Linux kernel could attempt to dereference     a null pointer in some situations. An attacker could use this to construct a malicious UDF image that,     when mounted and operated on, could cause a denial of service (system crash). (CVE-2022-0617)

    David Bouman discovered that the netfilter subsystem in the Linux kernel did not initialize memory in some     situations. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2022-1016)

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the tty subsystem in the Linux kernel contained a race condition in certain     situations, leading to an out-of-bounds read vulnerability. A local attacker could possibly use this to     cause a denial of service (system crash) or expose sensitive information. (CVE-2022-1462)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Duoming Zhou discovered a race condition in the NFC subsystem in the Linux kernel, leading to a use-after-     free vulnerability. A privileged local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-1974)

    Duoming Zhou discovered that the NFC subsystem in the Linux kernel did not properly prevent context     switches from occurring during certain atomic context operations. A privileged local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1975)

    It was discovered that the HID subsystem in the Linux kernel did not properly validate inputs in certain     conditions. A local attacker with physical access could plug in a specially crafted USB device to expose     sensitive information. (CVE-2022-20132)

    It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly     verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20572, CVE-2022-2503)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel     incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this     to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

    Lucas Leong discovered that the LightNVM subsystem in the Linux kernel did not properly handle data     lengths in certain situations. A privileged attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-2991)

    It was discovered that the Intel 740 frame buffer driver in the Linux kernel contained a divide by zero     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-3061)

    Jiasheng Jiang discovered that the wm8350 charger driver in the Linux kernel did not properly deallocate     memory, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a     denial of service (system crash). (CVE-2022-3111)

    It was discovered that the sound subsystem in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-     bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36280)

    It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. An attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2022-3646)

    It was discovered that the Netlink Transformation (XFRM) subsystem in the Linux kernel contained a     reference counting error. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-36879)

    It was discovered that the infrared transceiver USB driver did not properly handle USB control messages. A     local attacker with physical access could plug in a specially crafted USB device to cause a denial of     service (memory exhaustion). (CVE-2022-3903)

    Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain     situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-39188)

    Hyunwoo Kim discovered that the DVB Core driver in the Linux kernel did not properly perform reference     counting in some situations, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset     events. A local attacker with physical access could plug in a specially crafted USB device to cause a     denial of service (kernel deadlock). (CVE-2022-4662)

    It was discovered that the network queuing discipline implementation in the Linux kernel contained a null     pointer dereference in some situations. A local attacker could use this to cause a denial of service     (system crash). (CVE-2022-47929)

    Kyle Zeng discovered that the IPv6 implementation in the Linux kernel contained a NULL pointer dereference     vulnerability in certain situations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0394)

    It was discovered that a memory leak existed in the SCTP protocol implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2023-1074)

    Mingi Cho discovered that the netfilter subsystem in the Linux kernel did not properly initialize a data     structure, leading to a null pointer dereference vulnerability. An attacker could use this to cause a     denial of service (system crash). (CVE-2023-1095)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

    It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate     attributes in certain situations, leading to an out-of-bounds read vulnerability. A local attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-26607)

    Duoming Zhou discovered that a race condition existed in the infrared receiver/transceiver driver in the     Linux kernel, leading to a use-after- free vulnerability. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-1118)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1205 advisory.

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2615-1 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input     Validation. This flaw allows a local attacker with a special privilege to crash the system or leak     internal information. (CVE-2021-4204)

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not     properly update bounds while handling the mov32 instruction, which allows local users to obtain     potentially sensitive address information, aka a pointer leak. (CVE-2021-45402)

  - A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace. A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6 (CVE-2022-0264)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an     attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
    (CVE-2022-1198)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

  - An out-of-bounds read flaw was found in the Linux kernel's io_uring module in the way a user triggers the     io_read() function with some special parameters. This flaw allows a local user to read some memory out of     bounds. (CVE-2022-1508)

  - A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function     in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to     leak unauthorized kernel information, causing a denial of service. (CVE-2022-1651)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux     kernel. This flaw allows a local attacker to crash the system or leak internal kernel information.
    (CVE-2022-1671)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

  - A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information. (CVE-2022-1974)

  - A use after free in the Linux kernel File System notify functionality was found in the way user triggers     copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to     crash the system or potentially escalate their privileges on the system. (CVE-2022-1998)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21127)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially     cause a denial of service via local access. (CVE-2022-21180)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to     the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be     encountered. In one case, an error encountered earlier might be discarded by later processing, resulting     in the caller assuming successful mapping, and hence subsequent operations trying to access space that     wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery     from the error. This affects drivers/block/xen-blkback/blkback.c. (CVE-2021-26930)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when     transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context.
    This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
    (CVE-2021-38300)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the     O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a     regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file     descriptor. (CVE-2022-24448)

  - drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
    (CVE-2022-24958)

  - An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive     information from kernel memory. (CVE-2022-25375)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not     validated and might be manipulated by the host for out-of-array access. (CVE-2022-27223)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain,which can cause a use-     after-free.This issue needs to handle return with proper preconditions,as it can lead to a kernel     information leak problem caused by a local,unprivileged attacker. (CVE-2022-1016)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A use-after-free flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in the     way a user connects with the protocol. This flaw allows a local user to crash the system. (CVE-2022-1204)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c function in     RPCRDMA_HDRLEN_MIN (7) (in rpcrdma_max_call_header_size, rpcrdma_max_reply_header_size). This flaw allows     an attacker with normal user privileges to leak kernel information. (CVE-2022-0812)

  - kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak     (CVE-2022-1012)

  - No description is available for this CVE. (CVE-2022-1198)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A use-after-free flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in the     way a user connects with the protocol. This flaw allows a local user to crash the system. (CVE-2022-1204)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5541-1 advisory.

    Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not     perform permission checks correctly in some situations. A local attacker could possibly use this to gain     administrative privileges. (CVE-2021-4197)

    Jann Horn discovered that the FUSE file system in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2022-1011)

    Duoming Zhou discovered that the 6pack protocol implementation in the Linux kernel did not handle detach     events properly in some situations, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1198)

    Duoming Zhou discovered that the AX.25 amateur radio protocol implementation in the Linux kernel did not     handle detach events properly in some situations. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2022-1199)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel during device detach operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-1204)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the PF_KEYv2 implementation in the Linux kernel did not properly initialize kernel     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-1353)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    It was discovered that the 8 Devices USB2CAN interface implementation in the Linux kernel did not properly     handle certain error conditions, leading to a double-free. A local attacker could possibly use this to     cause a denial of service (system crash). (CVE-2022-28388)

    It was discovered that the Microchip CAN BUS Analyzer interface implementation in the Linux kernel did not     properly handle certain error conditions, leading to a double-free. A local attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-28389)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

  - No description is available for this CVE. (CVE-2022-1198)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5539-1 advisory.

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered that the AX.25 amateur radio protocol implementation in the Linux kernel did not     handle detach events properly in some situations. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2022-1199)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel during device detach operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-1204)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle     guest TLB mapping invalidation requests in some situations. An attacker in a guest VM could use this to     cause a denial of service (system crash) in the host OS. (CVE-2022-1789)

    It was discovered that the 8 Devices USB2CAN interface implementation in the Linux kernel did not properly     handle certain error conditions, leading to a double-free. A local attacker could possibly use this to     cause a denial of service (system crash). (CVE-2022-28388)

    Minh Yuan discovered that the floppy driver in the Linux kernel contained a race condition in some     situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-33981)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2520-1 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input     Validation. This flaw allows a local attacker with a special privilege to crash the system or leak     internal information. (CVE-2021-4204)

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not     properly update bounds while handling the mov32 instruction, which allows local users to obtain     potentially sensitive address information, aka a pointer leak. (CVE-2021-45402)

  - A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace. A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6 (CVE-2022-0264)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an     attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
    (CVE-2022-1198)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - An out-of-bounds read flaw was found in the Linux kernel's io_uring module in the way a user triggers the     io_read() function with some special parameters. This flaw allows a local user to read some memory out of     bounds. (CVE-2022-1508)

  - A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function     in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to     leak unauthorized kernel information, causing a denial of service. (CVE-2022-1651)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux     kernel. This flaw allows a local attacker to crash the system or leak internal kernel information.
    (CVE-2022-1671)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

  - A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information. (CVE-2022-1974)

  - A use after free in the Linux kernel File System notify functionality was found in the way user triggers     copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to     crash the system or potentially escalate their privileges on the system. (CVE-2022-1998)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21127)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially     cause a denial of service via local access. (CVE-2022-21180)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c function in     RPCRDMA_HDRLEN_MIN (7) (in rpcrdma_max_call_header_size, rpcrdma_max_reply_header_size). This flaw allows     an attacker with normal user privileges to leak kernel information. (CVE-2022-0812)

  - kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak     (CVE-2022-1012)

  - No description is available for this CVE. (CVE-2022-1198)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A use-after-free flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in the     way a user connects with the protocol. This flaw allows a local user to crash the system. (CVE-2022-1204)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux     kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of     service (DoS) or a kernel information leak. (CVE-2022-1280)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

  - No description is available for this CVE. (CVE-2022-1198)

  - kernel: Null pointer dereference and use after free in ax25_release() (CVE-2022-1199)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5514-1 advisory.

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered that the AX.25 amateur radio protocol implementation in the Linux kernel did not     handle detach events properly in some situations. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2022-1199)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel during device detach operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-1204)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    Yongkang Jia discovered that the KVM hypervisor implementation in the Linux kernel did not properly handle     guest TLB mapping invalidation requests in some situations. An attacker in a guest VM could use this to     cause a denial of service (system crash) in the host OS. (CVE-2022-1789)

    Minh Yuan discovered that the floppy driver in the Linux kernel contained a race condition in some     situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-33981)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5515-1 advisory.

    Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not     perform permission checks correctly in some situations. A local attacker could possibly use this to gain     administrative privileges. (CVE-2021-4197)

    Jann Horn discovered that the FUSE file system in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2022-1011)

    Duoming Zhou discovered that the 6pack protocol implementation in the Linux kernel did not handle detach     events properly in some situations, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1198)

    Duoming Zhou discovered that the AX.25 amateur radio protocol implementation in the Linux kernel did not     handle detach events properly in some situations. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2022-1199)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel during device detach operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-1204)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the PF_KEYv2 implementation in the Linux kernel did not properly initialize kernel     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-1353)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    Zheyu Ma discovered that the Silicon Motion SM712 framebuffer driver in the Linux kernel did not properly     handle very small reads. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-2380)

    It was discovered that the Microchip CAN BUS Analyzer interface implementation in the Linux kernel did not     properly handle certain error conditions, leading to a double-free. A local attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-28389)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5173 advisory.

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - An information leak flaw was found in NFS over RDMA in the net/sunrpc/xprtrdma/rpc_rdma.c in the Linux     Kernel. This flaw allows an attacker with normal user privileges to leak kernel information.
    (CVE-2022-0812)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when     transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context.
    This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
    (CVE-2021-38300)

  - In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This     could lead to local information disclosure with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-150694665References: Upstream kernel (CVE-2021-39633)

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak     because the hash table is very small. (CVE-2021-45486)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way     user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw     to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. (CVE-2022-0617)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the     O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a     regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file     descriptor. (CVE-2022-24448)

  - drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
    (CVE-2022-24958)

  - An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The     RNDIS USB gadget lacks validation of the size of the RNDIS_MSG_SET command. Attackers can obtain sensitive     information from kernel memory. (CVE-2022-25375)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not     validated and might be manipulated by the host for out-of-array access. (CVE-2022-27223)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5471-1 advisory.

    It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when     booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot     restrictions. (CVE-2022-21499)

    Aaron Adams discovered that the netfilter subsystem in the Linux kernel did not properly handle the     removal of stateful expressions in some situations, leading to a use-after-free vulnerability. A local     attacker could use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2022-1966)

    Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not     provide sufficient randomization when calculating port offsets. An attacker could possibly use this to     expose sensitive information. (CVE-2022-1012)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    It was discovered that the Marvell NFC device driver implementation in the Linux kernel did not properly     perform memory cleanup operations in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2022-1734)

    Minh Yuan discovered that the floppy driver in the Linux kernel contained a race condition in some     situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-1836)

    Ziming Zhang discovered that the netfilter subsystem in the Linux kernel did not properly validate sets     with multiple ranged fields. A local attacker could use this to cause a denial of service or execute     arbitrary code. (CVE-2022-1972)

    Joseph Ravichandran and Michael Wang discovered that the io_uring subsystem in the Linux kernel did not     properly initialize data in some situations. A local attacker could use this to expose sensitive     information (kernel memory). (CVE-2022-29968)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5469-1 advisory.

    It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when     booted in secure boot environments. A privileged attacker could use this to bypass UEFI Secure Boot     restrictions. (CVE-2022-21499)

    Aaron Adams discovered that the netfilter subsystem in the Linux kernel did not properly handle the     removal of stateful expressions in some situations, leading to a use-after-free vulnerability. A local     attacker could use this to cause a denial of service (system crash) or execute arbitrary code.
    (CVE-2022-1966)

    Billy Jheng Bing Jhong discovered that the CIFS network file system implementation in the Linux kernel did     not properly validate arguments to ioctl() in some situations. A local attacker could possibly use this to     cause a denial of service (system crash). (CVE-2022-0168)

    Hu Jiahui discovered that multiple race conditions existed in the Advanced Linux Sound Architecture (ALSA)     framework, leading to use-after-free vulnerabilities. A local attacker could use these to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-1048)

    Qiuhao Li, Gaoning Pan and Yongkang Jia discovered that the KVM implementation in the Linux kernel did not     properly perform guest page table updates in some situations. An attacker in a guest vm could possibly use     this to crash the host OS. (CVE-2022-1158)

    It was discovered that the implementation of the 6pack and mkiss protocols in the Linux kernel did not     handle detach events properly in some situations, leading to a use-after-free vulnerability. A local     attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1195)

    Duoming Zhou discovered that the 6pack protocol implementation in the Linux kernel did not handle detach     events properly in some situations, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-1198)

    Duoming Zhou discovered that the AX.25 amateur radio protocol implementation in the Linux kernel did not     handle detach events properly in some situations. A local attacker could possibly use this to cause a     denial of service (system crash) or execute arbitrary code. (CVE-2022-1199)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel during device detach operations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-1204)

    Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux     kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a     denial of service (system crash). (CVE-2022-1205)

    Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the kvm implementation in the Linux kernel did     not handle releasing a virtual cpu properly. A local attacker in a guest VM coud possibly use this to     cause a denial of service (host system crash). (CVE-2022-1263)

    It was discovered that the PF_KEYv2 implementation in the Linux kernel did not properly initialize kernel     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2022-1353)

    It was discovered that the implementation of X.25 network protocols in the Linux kernel did not terminate     link layer sessions properly. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2022-1516)

    It was discovered that the ACRN Hypervisor Service Module implementation in the Linux kernel did not     properly deallocate memory in some situations. A local privileged attacker could possibly use this to     cause a denial of service (memory exhaustion). (CVE-2022-1651)

    It was discovered that the RxRPC session socket implementation in the Linux kernel did not properly handle     ioctls called when no security protocol is given. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information (kernel memory). (CVE-2022-1671)

    Ziming Zhang discovered that the netfilter subsystem in the Linux kernel did not properly validate sets     with multiple ranged fields. A local attacker could use this to cause a denial of service or execute     arbitrary code. (CVE-2022-1972)

     discovered that the 802.2 LLC type 2 driver in the Linux kernel did not properly perform     reference counting in some error conditions. A local attacker could use this to cause a denial of service.
    (CVE-2022-28356)

    It was discovered that the 8 Devices USB2CAN interface implementation in the Linux kernel did not properly     handle certain error conditions, leading to a double-free. A local attacker could possibly use this to     cause a denial of service (system crash). (CVE-2022-28388)

    It was discovered that the Microchip CAN BUS Analyzer interface implementation in the Linux kernel did not     properly handle certain error conditions, leading to a double-free. A local attacker could possibly use     this to cause a denial of service (system crash). (CVE-2022-28389)

    It was discovered that the EMS CAN/USB interface implementation in the Linux kernel contained a double-     free vulnerability when handling certain error conditions. A local attacker could use this to cause a     denial of service (memory exhaustion). (CVE-2022-28390)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.38 / 5.15.38_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-129-01 advisory.

  - Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure via local access. (CVE-2022-0001)

  - Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2022-0500)

  - Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making     it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit     2d3916f3189172d5c69d33065c3c21119fe539fc. (CVE-2022-0742)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - An out-of-bounds (OOB) memory write flaw was found in the Linux kernel's watch_queue event notification     subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain     privileged access or cause a denial of service on the system. (CVE-2022-0995)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
    (CVE-2022-24958)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5127 advisory.

  - An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1407-1 advisory.

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an     attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
    (CVE-2022-1198)

  - A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating     amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free     vulnerability. (CVE-2022-1199)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1183-1 advisory.

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an     attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
    (CVE-2022-1198)

  - A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating     amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free     vulnerability. (CVE-2022-1199)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1163-1 advisory.

  - In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This     could lead to local escalation of privilege with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-185125206References: Upstream kernel (CVE-2021-39698)

  - The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not     properly update bounds while handling the mov32 instruction, which allows local users to obtain     potentially sensitive address information, aka a pointer leak. (CVE-2021-45402)

  - In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota     tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a     corrupted quota file. (CVE-2021-45868)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

  - A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain     privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past     commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 (CVE-2022-1055)

  - A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a     local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device     is detached and reclaim resources early. (CVE-2022-1195)

  - A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an     attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.
    (CVE-2022-1198)

  - A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating     amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free     vulnerability. (CVE-2022-1199)

  - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality     in the way a user connects with the protocol. This flaw allows a local user to crash the system.
    (CVE-2022-1205)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not     validated and might be manipulated by the host for out-of-array access. (CVE-2022-27223)

  - A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and     net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap     objects and may cause a local privilege escalation threat. (CVE-2022-27666)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28389)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
174228	Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-6014-1)	Nessus	Ubuntu Local Security Checks	high
173946	Ubuntu 16.04 ESM : Linux kernel (AWS) vulnerabilities (USN-6001-1)	Nessus	Ubuntu Local Security Checks	high
173599	CBL Mariner 2.0 Security Update: kernel (CVE-2022-1205)	Nessus	MarinerOS Local Security Checks	medium
163692	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2615-1)	Nessus	SuSE Local Security Checks	high
163617	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2022-2200)	Nessus	Huawei Local Security Checks	high
163565	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2134)	Nessus	Huawei Local Security Checks	high
163545	Ubuntu 16.04 ESM : Linux kernel (Azure) vulnerabilities (USN-5541-1)	Nessus	Ubuntu Local Security Checks	high
163543	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2159)	Nessus	Huawei Local Security Checks	high
163525	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5539-1)	Nessus	Ubuntu Local Security Checks	medium
163378	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:2520-1)	Nessus	SuSE Local Security Checks	high
163171	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2022-2090)	Nessus	Huawei Local Security Checks	high
163167	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2022-2110)	Nessus	Huawei Local Security Checks	high
163113	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5514-1)	Nessus	Ubuntu Local Security Checks	medium
163111	Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel vulnerabilities (USN-5515-1)	Nessus	Ubuntu Local Security Checks	high
162703	Debian DSA-5173-1 : linux - security update	Nessus	Debian Local Security Checks	high
162249	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2022-1868)	Nessus	Huawei Local Security Checks	high
161958	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5471-1)	Nessus	Ubuntu Local Security Checks	high
161955	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-5469-1)	Nessus	Ubuntu Local Security Checks	high
160874	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2022-129-01)	Nessus	Slackware Local Security Checks	high
160469	Debian DSA-5127-1 : linux - security update	Nessus	Debian Local Security Checks	high
160222	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:1407-1)	Nessus	SuSE Local Security Checks	high
159739	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:1183-1)	Nessus	SuSE Local Security Checks	high
159698	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:1163-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-1205

medium

Tenable Plugins

high

high

medium

high

high

high

high

high

medium

high

high

high

medium

high

high

high

high

high

high

high

high

high

high