Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5216 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a     duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2022-1966)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5232 advisory.

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a     duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2022-1966)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.126-117.518. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-015 advisory.

  - A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the     small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of     service problem. (CVE-2022-1012)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a     duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2022-1966)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2078. Reason: This candidate is a     reservation duplicate of CVE-2022-2078. Notes: All CVE users should reference CVE-2022-2078 instead of     this candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage (CVE-2022-1972)

  - A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 (Double-Hash Port Selection Algorithm) of RFC 6056.
    (CVE-2022-32296)

  - An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5249 advisory.

    - lockdown: also lock down previous kgdb use (Daniel Thompson) [Orabug: 34290418] {CVE-2022-21499}
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2092994 2092995]     {CVE-2022-1966}
    - perf: Fix sys_perf_event_open() race against self (Michael Petlan) [2087963 2087964] {CVE-2022-1729}
    - tcp: drop the hash_32() part from the index calculation (Guillaume Nault) [2087128 2064868]     {CVE-2022-1012}
    - tcp: increase source port perturb table to 2^16 (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
    - tcp: dynamically allocate the perturb table used by source ports (Guillaume Nault) [2087128 2064868]     {CVE-2022-1012}
    - tcp: add small random increments to the source port (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
    - tcp: resalt the secret every 10 seconds (Guillaume Nault) [2087128 2064868] {CVE-2022-1012}
    - tcp: use different parts of the port_offset for index and offset (Guillaume Nault) [2087128 2064868]     {CVE-2022-1012}
    - secure_seq: use the 64 bits of the siphash for port offset calculation (Guillaume Nault) [2087128     2064868] {CVE-2022-1012}
    - esp: limit skb_page_frag_refill use to a single page (Sabrina Dubroca) [2082950 2082951]     {CVE-2022-27666}
    - esp: Fix possible buffer overflow in ESP transformation (Sabrina Dubroca) [2082950 2082951]     {CVE-2022-27666}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5232 advisory.

    - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499}
    - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2093000]     {CVE-2022-1966}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5267 advisory.

  - kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak     (CVE-2022-1012)

  - kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

  - kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

  - kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5224 advisory.

  - kernel: the copy-on-write implementation can grant unintended write access because of a race condition in     a THP mapcount check (CVE-2020-29368)

  - kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak     (CVE-2022-1012)

  - kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

  - kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

  - kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208562	CentOS 7 : kpatch-patch (RHSA-2022:5216)	Nessus	CentOS Local Security Checks	high
203749	Photon OS 3.0: Linux PHSA-2022-3.0-0409	Nessus	PhotonOS Local Security Checks	high
203411	Photon OS 4.0: Linux PHSA-2022-4.0-0195	Nessus	PhotonOS Local Security Checks	high
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	critical
187326	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)	Nessus	NewStart CGSL Local Security Checks	high
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	high
163735	CentOS 7 : kernel (RHSA-2022:5232)	Nessus	CentOS Local Security Checks	high
163313	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-015)	Nessus	Amazon Linux Local Security Checks	high
162791	Oracle Linux 9 : kernel (ELSA-2022-5249)	Nessus	Oracle Linux Local Security Checks	high
162587	Oracle Linux 7 : kernel (ELSA-2022-5232)	Nessus	Oracle Linux Local Security Checks	high
162574	RHEL 9 : kernel-rt (RHSA-2022:5267)	Nessus	Red Hat Local Security Checks	high
162571	RHEL 8 : kernel-rt (RHSA-2022:5224)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-1966

No Score

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high