Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7337 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by     its CNA. Notes: none. (CVE-2022-23816)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0. (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - VMware ESXi contains Return-Stack-Buffer-Underflow (CVE-2022-29901, CVE-2022-28693, CVE-2022-26373) and     Branch Type Confusion (CVE-2022-23816, CVE-2022-23825) vulnerabilities due to the Intel and AMD processors     it utilizes. VMware has evaluated the severity of these issues to be in the Moderate severity range with a     maximum CVSSv3 base score of 5.6. (CVE-2022-28693)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12433 advisory.

    - x86/static_call: Add support for Jcc tail-calls (Peter Zijlstra)   {CVE-2022-29901} {CVE-2022-23816}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: Buffer overflow due to unbounded strcpy in ISDN I4L driver (CVE-2017-12762)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group     ID of zero from reaching the swapper process, which allows local users to cause a denial of service     (system crash) by leveraging access to this process group. (CVE-2010-5328)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote VMware ESXi host is version 6.5, 6.7 or 7.0 and is affected by multiple vulnerabilities, as follows:

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack     return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent     conditions. (CVE-2022-29901)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading     to information disclosure. (CVE-2022-23825)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202402-07 (Xen: Multiple Vulnerabilities)

  - grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted     access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with     a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest     switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the     guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests     from the guest to insert mappings of these pages may result in any of them to become mapped in multiple     locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed     and perhaps re-used for other purposes. This bug was fortuitously fixed by code cleanup in Xen 4.14, and     backported to security-supported Xen branches as a prerequisite of the fix for XSA-378. (CVE-2021-28703)

  - PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains     which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-     on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are     permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on     ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation     of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for     the specified order, yet some code involved in PoD handling actually makes such an assumption. These     operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707),     the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain.
    (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation     can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708,     patch 2). (CVE-2021-28704, CVE-2021-28707, CVE-2021-28708)

  - issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be     started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory     assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These     hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of     pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error     handling in certain PoD cases has been insufficient in that in particular partial success of some     operations was not properly accounted for. There are two code paths affected - page removal     (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix     to both issues.) (CVE-2021-28705, CVE-2021-28709)

  - guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of     memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator     established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It     would then only be the overflowed (and hence small) number which gets compared against the established     upper bound. (CVE-2021-28706)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by     its CNA. Notes: none. (CVE-2022-23816)

  - IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to     a potential information disclosure. (CVE-2022-23824)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode     done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing     log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while     another CPU is still in the process of tearing down the structures related to a previously enabled log     dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both     operations and can lead to entries being added in already freed slots, resulting in a memory leak.
    (CVE-2022-26356)

  - race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only     less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore     internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping     structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.
    (CVE-2022-26357)

  - IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a     system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, RMRR)     for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as     legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with     such a region is active, the mappings of these regions need to remain continuouly accessible by the     device. This requirement has been violated. Subsequent DMA or interrupts from the device may have     unpredictable behaviour, ranging from IOMMU faults to memory corruption. (CVE-2022-26358, CVE-2022-26359,     CVE-2022-26360, CVE-2022-26361)

  - When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the     sibling thread after an SMT mode switch potentially resulting in information disclosure. (CVE-2022-27672)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages     from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the     2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping     with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious     guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings.
    (CVE-2022-33747)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit     its file-descriptor limit. This causes XAPI to be unable to accept new requests for other (trusted)     clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors.
    (CVE-2022-33749)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest,     xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only     after the request has been finished completely. A request is regarded to be finished only after the guest     has read the response message of the request from the ring page. Thus a guest not reading the response can     cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of     Service (DoS) of xenstored. (CVE-2022-42319)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

  - Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision.
    The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In     64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and     then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic     not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception     is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the     xenstore ring. (CVE-2022-42324)

  - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In     case a node has been created in a transaction and it is later deleted in the same transaction, the     transaction will be terminated with an error. As this error is encountered only when handling the deleted     node at transaction finalization, the transaction will have been performed partially and without updating     the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
    (CVE-2022-42325, CVE-2022-42326)

  - x86: unintended memory sharing between guests On Intel systems that support the virtualize APIC accesses     feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC     mode. Access to this shared page bypasses the expected isolation that should exist between two guests.
    (CVE-2022-42327)

  - Guests can cause Xenstore crash via soft reset When a guest issues a Soft Reset (e.g. for performing a     kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug     in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same     impact. (CVE-2022-42330)

  - x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original     Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late.
    In some configurations, there is an unprotected RET instruction which can be attacked with a variety of     speculative attacks. (CVE-2022-42331)

  - x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is     necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode.
    Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data     structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The     data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to     keep error handling efforts within reasonable bounds, for operations which may require memory allocations     shadow mode logic ensures up front that enough memory is available for the worst case requirements.
    Unfortunately, while page table memory is properly accounted for on the code path requiring the potential     establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As     a result, just established shadow page tables could be freed again immediately, while other code is still     accessing them on the assumption that they would remain allocated. (CVE-2022-42332)

  - x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the     text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM     guests with passed through devices, an interface exists to explicitly override defaults which would     otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically     exists for domains controlling such guests. This interface may therefore be used by not fully privileged     entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this     exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), -     installation and removal of such regions was not properly serialized (CVE-2022-42334). (CVE-2022-42333,     CVE-2022-42334)

  - x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is     necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode.
    Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for     a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially     under guest control. (CVE-2022-42335)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8267 advisory.

    - posix-cpu-timers: Cleanup CPU timers before freeing them during exec (Wander Lairson Costa) [2116968]     {CVE-2022-2585}
    - fix race between exit_itimers() and /proc/pid/timers (Wander Lairson Costa) [2116968] {CVE-2022-2585}
    - ath9k: htc: clean up statistics macros (Jose Ignacio Tornos Martinez) [2084600] {CVE-2022-1679}
    - ath9k: hif_usb: simplify if-if to if-else (Jose Ignacio Tornos Martinez) [2084600] {CVE-2022-1679}
    - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Jose Ignacio Tornos Martinez) [2084600]     {CVE-2022-1679}
    - x86/speculation: Add LFENCE to RSB fill sequence (Waiman Long) [2115086] {CVE-2022-26373}
    - x86/speculation: Add RSB VM Exit protections (Waiman Long) [2115086] {CVE-2022-26373}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-185 advisory.

    A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

    A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

    An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg     callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause     a kernel oops condition on the host, resulting in a denial of service. (CVE-2022-1789)

    A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

    A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in     net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege     escalation issue. (CVE-2022-1966)

    No description is available for this CVE. (CVE-2022-1972)

    A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal.
    This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
    (CVE-2022-1973)

    A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

    A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel(r) Processors may     allow an authenticated user to enable information disclosure via local access. (CVE-2022-21123)

    A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel(r) Processors     may allow an authenticated user to enable information disclosure via local access. (CVE-2022-21125)

    A flaw was found in hw. Incomplete cleanup in specific special register write operations for some     Intel Processors may allow an authenticated user to enable information disclosure via local access.
    (CVE-2022-21166)

    A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505)

    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-23816)

    A flaw was found in hw. Aliases in the branch predictor may cause some AMD processors to predict the wrong     branch type, potentially leading to information disclosure. (CVE-2022-23825)

    A use-after-free flaw was found in the Linux kernel's POSIX CPU timers functionality in the way a user     creates and then deletes the timer in the non-leader thread of the program. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2022-2585)

    A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in     the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the     time of table deletion, possibly leading to local privilege escalation. (CVE-2022-2586)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365)

    A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation     (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most     recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction.
    (CVE-2022-26373)

    A firewall flaw that can bypass the Linux kernel's Netfilter functionality was found in how a user handles     unencrypted IRC with nf_conntrack_irc configured. This flaw allows a remote user to gain unauthorized     access to the system. (CVE-2022-2663)

    A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some     Intel(R) Processors may allow an authorized user to enable information disclosure via local access.
    (CVE-2022-28693)

    An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-29900)

    A flaw was found in hw. Non-transparent sharing of branch predictor targets between contexts in some     Intel(R) processors may potentially allow an authorized user to enable information disclosure via local     access. (CVE-2022-29901)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

    A use-after-free flaw was found in io_uring in the Linux kernel. This flaw allows a local user to trigger     the issue if a signalfd or binder fd is polled with the io_uring poll due to a lack of io_uring POLLFREE     handling. (CVE-2022-3176)

    net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

    An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

    A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition. (CVE-2022-3303)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33740)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33741)

    Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-33742)

    network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

    rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a     double free. (CVE-2022-34494)

    rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
    (CVE-2022-34495)

    A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides     incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2022-34918)

    A memory access flaw was found in the Linux kernel's XEN hypervisor for the virtual machine. This flaw     allows a local user to crash the system or potentially escalate their privileges on the system.
    (CVE-2022-36123)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    A flaw was found in the x86 KVM subsystem in kvm_steal_time_set_preempted in arch/x86/kvm/x86.c in the     Linux kernel. Unprivileged guest users can compromise the guest kernel because TLB flush operations are     mishandled in certain KVM_VCPU_PREEMPTED situations. (CVE-2022-39189)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

    An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. (CVE-2022-39842)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7337 advisory.

    - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499}
    - x86/speculation: Add LFENCE to RSB fill sequence (Rafael Aquini) [2115073] {CVE-2022-26373}
    - x86/speculation: Protect against userspace-userspace spectreRSB (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/speculation: cope with spectre_v2=retpoline cmdline on retbleed-affected Intel CPUs (Rafael Aquini)     [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/speculation: Disable RRSBA behavior (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/kexec: Disable RET on kexec (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpu/amd: Enumerate BTC_NO (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/common: Stamp out the stepping madness (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/cpu/amd: Add Spectral Chicken (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Do IBPB fallback check only once (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Add retbleed=ibpb (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/bugs: Report Intel retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Enable STIBP for JMP2RET (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Add AMD retbleed= boot parameter (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Report AMD retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86: Add magic AMD return-thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86: Use return-thunk in asm code (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/sev: Avoid using __x86_return_thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: Fix SETcc emulation for return thunks (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86,objtool: Create .return_sites (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86: Undo return-thunk damage (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/retpoline: Use -mfunction-return (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Move RETPOLINE flags to word 11 (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - objtool: Add ELF writing capability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86: Prepare asm files for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86: Prepare inline-asm for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: Fix fastop function ELF metadata (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: Move kvm_fastop_exception to .fixup section (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/vdso: Fix vDSO build if a retpoline is emitted (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Carve out CQM features retrieval (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Re-tabulate the X86_FEATURE definitions (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeature: Move processor tracing out of scattered features (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/alternatives: Cleanup DPRINTK macro (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - net_sched: cls_route: remove from list when handle is 0 (Davide Caratti) [2121809] {CVE-2022-2588}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-127 advisory.

    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-23816)

    A flaw was found in hw. Aliases in the branch predictor may cause some AMD processors to predict the wrong     branch type, potentially leading to information disclosure. (CVE-2022-23825)

    A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation     (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most     recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction.
    (CVE-2022-26373)

    A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some     Intel(R) Processors may allow an authorized user to enable information disclosure via local access.
    (CVE-2022-28693)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.57-29.131. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2022-006 advisory.

    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-23816)

    A flaw was found in hw. Aliases in the branch predictor may cause some AMD processors to predict the wrong     branch type, potentially leading to information disclosure. (CVE-2022-23825)

    A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation     (eIBRS) capabilities, soon after VM exit or IBPB command event, the linear address following the most     recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer (RSB) prediction.
    (CVE-2022-26373)

    A flaw was found in hw. The unprotected alternative channel of return branch target prediction in some     Intel(R) Processors may allow an authorized user to enable information disclosure via local access.
    (CVE-2022-28693)

    A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-29900)

    A flaw was found in hw. Non-transparent sharing of branch predictor targets between contexts in some     Intel(R) processors may potentially allow an authorized user to enable information disclosure via local     access. (CVE-2022-29901)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9709 advisory.

    - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug:
    34480880]  {CVE-2022-2588}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Paolo Bonzini)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Thadeu Lima de Souza Cascardo)  [Orabug:
    34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt (Alexandre Chartre)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Disable RRSBA behavior (Pawan Gupta)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/exec: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM/VMX: Use TEST %REG,%REG instead of CMP     /u03/ksharma/errata_processing/work/el7uek6/db_7uek6.ELSA-2022-9709,%REG in vmenter.S (Uros Bizjak)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw (Uros Bizjak)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - kbuild/objtool: Add objtool-vmlinux.o pass (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra     (Intel))  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vmlinux: Use INT3 instead of NOP for linker fill bytes (Kees Cook)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/realmode: build with __DISABLE_EXPORTS (Ankur Arora)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bpf: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: elide references to .discard.* from .return_sites (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Support not-feature (Juergen Gross)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/features: Move RETPOLINE flags to word 11 (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Classify symbols (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Create reloc sections implicitly (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add elf_create_reloc() helper (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rework the elf_rebuild_reloc_section() logic (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Handle per arch retpoline naming (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Correctly handle retpoline thunk calls (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Support retpoline jump detection for vmlinux.o (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add 'alt_group' struct (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Clean up elf_write() condition (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add support for relocations without addends (Matt Helsley)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Rename rela to reloc (Matt Helsley)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: optimize add_dead_ends for split sections (Sami Tolvanen)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Move the IRET hack into the arch decoder (Miroslav Benes)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename elf_read() to elf_open_read() (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Constify 'struct elf *' parameters (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize !vmlinux.o again (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Better handle IRET (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/unwind_hints: define unwind_hint_save, unwind_hint_restore (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add abstraction for destination offsets (Raphael Gault)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Fix off-by-one in symbol_by_offset() (Julien Thierry)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_rela_by_dest_range() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize read_sections() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename find_containing_func() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_*() and read_symbols() (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_section_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_section_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add a statistics mode (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn_all() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Introduce validate_return() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Improve call destination function detection (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Fix clang switch table edge case (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add relocation check for alternative sections (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add is_static_jump() helper (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug: 34400675]     {CVE-2022-21505}
    - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly     Kuznetsov)  [Orabug: 34323859]  {CVE-2022-2153}
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug:
    34323859]  {CVE-2022-2153}
    - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323859]     {CVE-2022-2153}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9710 advisory.

    - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug:
    34480880]  {CVE-2022-2588}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Paolo Bonzini)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Thadeu Lima de Souza Cascardo)  [Orabug:
    34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt (Alexandre Chartre)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Disable RRSBA behavior (Pawan Gupta)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/exec: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM/VMX: Use TEST %REG,%REG instead of CMP     /u03/ksharma/errata_processing/work/el7uek6/db_7uek6.ELSA-2022-9710,%REG in vmenter.S (Uros Bizjak)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw (Uros Bizjak)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - kbuild/objtool: Add objtool-vmlinux.o pass (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra     (Intel))  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vmlinux: Use INT3 instead of NOP for linker fill bytes (Kees Cook)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/realmode: build with __DISABLE_EXPORTS (Ankur Arora)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bpf: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: elide references to .discard.* from .return_sites (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Support not-feature (Juergen Gross)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/features: Move RETPOLINE flags to word 11 (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Classify symbols (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Create reloc sections implicitly (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add elf_create_reloc() helper (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rework the elf_rebuild_reloc_section() logic (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Handle per arch retpoline naming (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Correctly handle retpoline thunk calls (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Support retpoline jump detection for vmlinux.o (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add 'alt_group' struct (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Clean up elf_write() condition (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add support for relocations without addends (Matt Helsley)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Rename rela to reloc (Matt Helsley)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: optimize add_dead_ends for split sections (Sami Tolvanen)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Move the IRET hack into the arch decoder (Miroslav Benes)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename elf_read() to elf_open_read() (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Constify 'struct elf *' parameters (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize !vmlinux.o again (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Better handle IRET (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/unwind_hints: define unwind_hint_save, unwind_hint_restore (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add abstraction for destination offsets (Raphael Gault)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Fix off-by-one in symbol_by_offset() (Julien Thierry)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_rela_by_dest_range() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize read_sections() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename find_containing_func() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_*() and read_symbols() (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_section_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_section_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add a statistics mode (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn_all() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Introduce validate_return() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Improve call destination function detection (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Fix clang switch table edge case (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add relocation check for alternative sections (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add is_static_jump() helper (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug: 34400675]     {CVE-2022-21505}
    - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly     Kuznetsov)  [Orabug: 34323859]  {CVE-2022-2153}
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug:
    34323859]  {CVE-2022-2153}
    - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323859]     {CVE-2022-2153}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c69ef9c1dd advisory.

    The 5.18.11 stable kernel update contains a number of important fixes across the tree. In addition to the     5.18.11 stable patches, this build contains the retbleed patches scheduled for 5.18.12 kernels.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9591 advisory.

    - floppy: use a statically allocated error counter (Willy Tarreau)  [Orabug: 34218638]  {CVE-2022-1652}
    - x86: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit (Josh Poimboeuf)  [Orabug:
    34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Update Retpoline validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra)     [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Report AMD retbleed vulnerability (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Add magic AMD return-thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - objtool: Treat .text.__x86.* as noinstr (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Use return-thunk in asm code (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bpf: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/ftrace: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86,static_call: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86,objtool: Create .return_sites (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Undo return-thunk damage (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/kvm/vmx: Make noinstr clean (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Remove skip_r11rcx (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Fix register corruption in compat syscall (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Use PUSH_AND_CLEAR_REGS for compat (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/entry: Simplify entry_INT80_compat() (Linus Torvalds)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86,static_call: Fix __static_call_return0 for i386 (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - objtool: Default ignore INT3 for unreachable (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/alternative: Relax text_poke_bp() constraint (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - static_call,x86: Robustify trampoline patching (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9590 advisory.

    - floppy: use a statically allocated error counter (Willy Tarreau)  [Orabug: 34218638]  {CVE-2022-1652}
    - x86: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit (Josh Poimboeuf)  [Orabug:
    34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra)     [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Treat .text.__x86.* as noinstr (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bpf: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,static_call: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/kvm/vmx: Make noinstr clean (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove skip_r11rcx (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Fix register corruption in compat syscall (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Use PUSH_AND_CLEAR_REGS for compat (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Simplify entry_INT80_compat() (Linus Torvalds)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86,static_call: Fix __static_call_return0 for i386 (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Default ignore INT3 for unreachable (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Relax text_poke_bp() constraint (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - static_call,x86: Robustify trampoline patching (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208564	CentOS 7 : kernel (RHSA-2022:7337)	Nessus	CentOS Local Security Checks	high
203263	Photon OS 4.0: Linux PHSA-2022-4.0-0248	Nessus	PhotonOS Local Security Checks	high
200470	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2024-12433)	Nessus	Oracle Linux Local Security Checks	medium
199273	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196163	RHEL 6 : hw (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
192466	VMware ESXi 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2022-0020)	Nessus	Misc.	medium
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	critical
189976	GLSA-202402-07 : Xen: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
187326	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)	Nessus	NewStart CGSL Local Security Checks	high
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	high
168085	Oracle Linux 9 : kernel (ELSA-2022-8267)	Nessus	Oracle Linux Local Security Checks	high
167017	Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-185)	Nessus	Amazon Linux Local Security Checks	high
166937	Oracle Linux 7 : kernel (ELSA-2022-7337)	Nessus	Oracle Linux Local Security Checks	high
166553	Oracle Linux 8 : kernel (ELSA-2022-7110)	Nessus	Oracle Linux Local Security Checks	high
164707	Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-127)	Nessus	Amazon Linux Local Security Checks	medium
164362	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-006)	Nessus	Amazon Linux Local Security Checks	high
164141	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9709)	Nessus	Oracle Linux Local Security Checks	high
164136	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9710)	Nessus	Oracle Linux Local Security Checks	high
163090	Fedora 36 : kernel (2022-c69ef9c1dd)	Nessus	Fedora Local Security Checks	medium
163037	Oracle Linux 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9591)	Nessus	Oracle Linux Local Security Checks	high
163036	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2022-9590)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2022-23816

No Score

Tenable Plugins

high

high

medium

critical

medium

medium

critical

high

high

high

high

high

high

high

medium

high

high

high

medium

high

high