Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7337 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by     its CNA. Notes: none. (CVE-2022-23816)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0. (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - VMware ESXi contains Return-Stack-Buffer-Underflow (CVE-2022-29901, CVE-2022-28693, CVE-2022-26373) and     Branch Type Confusion (CVE-2022-23816, CVE-2022-23825) vulnerabilities due to the Intel and AMD processors     it utilizes. VMware has evaluated the severity of these issues to be in the Moderate severity range with a     maximum CVSSv3 base score of 5.6. (CVE-2022-28693)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12433 advisory.

    - x86/static_call: Add support for Jcc tail-calls (Peter Zijlstra)   {CVE-2022-29901} {CVE-2022-23816}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: Buffer overflow due to unbounded strcpy in ISDN I4L driver (CVE-2017-12762)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group     ID of zero from reaching the swapper process, which allows local users to cause a denial of service     (system crash) by leveraging access to this process group. (CVE-2010-5328)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote VMware ESXi host is version 6.5, 6.7 or 7.0 and is affected by multiple vulnerabilities, as follows:

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack     return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent     conditions. (CVE-2022-29901)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading     to information disclosure. (CVE-2022-23825)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202402-07 (Xen: Multiple Vulnerabilities)

  - grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted     access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with     a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest     switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the     guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests     from the guest to insert mappings of these pages may result in any of them to become mapped in multiple     locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed     and perhaps re-used for other purposes. This bug was fortuitously fixed by code cleanup in Xen 4.14, and     backported to security-supported Xen branches as a prerequisite of the fix for XSA-378. (CVE-2021-28703)

  - PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains     which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be started in populate-     on-demand (PoD) mode, to provide a way for them to later easily have more memory assigned. Guests are     permitted to control certain P2M aspects of individual pages via hypercalls. These hypercalls may act on     ranges of pages specified via page orders (resulting in a power-of-2 number of pages). The implementation     of some of these hypercalls for PoD does not enforce the base page frame number to be suitably aligned for     the specified order, yet some code involved in PoD handling actually makes such an assumption. These     operations are XENMEM_decrease_reservation (CVE-2021-28704) and XENMEM_populate_physmap (CVE-2021-28707),     the latter usable only by domains controlling the guest, i.e. a de-privileged qemu or a stub domain.
    (Patch 1, combining the fix to both these two issues.) In addition handling of XENMEM_decrease_reservation     can also trigger a host crash when the specified page order is neither 4k nor 2M nor 1G (CVE-2021-28708,     patch 2). (CVE-2021-28704, CVE-2021-28707, CVE-2021-28708)

  - issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] x86 HVM and PVH guests may be     started in populate-on-demand (PoD) mode, to provide a way for them to later easily have more memory     assigned. Guests are permitted to control certain P2M aspects of individual pages via hypercalls. These     hypercalls may act on ranges of pages specified via page orders (resulting in a power-of-2 number of     pages). In some cases the hypervisor carries out the requests by splitting them into smaller chunks. Error     handling in certain PoD cases has been insufficient in that in particular partial success of some     operations was not properly accounted for. There are two code paths affected - page removal     (CVE-2021-28705) and insertion of new pages (CVE-2021-28709). (We provide one patch which combines the fix     to both issues.) (CVE-2021-28705, CVE-2021-28709)

  - guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of     memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator     established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It     would then only be the overflowed (and hence small) number which gets compared against the established     upper bound. (CVE-2021-28706)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by     its CNA. Notes: none. (CVE-2022-23816)

  - IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to     a potential information disclosure. (CVE-2022-23824)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode     done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing     log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while     another CPU is still in the process of tearing down the structures related to a previously enabled log     dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both     operations and can lead to entries being added in already freed slots, resulting in a memory leak.
    (CVE-2022-26356)

  - race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only     less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore     internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping     structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.
    (CVE-2022-26357)

  - IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Certain PCI devices in a     system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, RMRR)     for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as     legacy USB emulation. Since the precise purpose of these regions is unknown, once a device associated with     such a region is active, the mappings of these regions need to remain continuouly accessible by the     device. This requirement has been violated. Subsequent DMA or interrupts from the device may have     unpredictable behaviour, ranging from IOMMU faults to memory corruption. (CVE-2022-26358, CVE-2022-26359,     CVE-2022-26360, CVE-2022-26361)

  - When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the     sibling thread after an SMT mode switch potentially resulting in information disclosure. (CVE-2022-27672)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages     from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the     2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping     with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious     guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings.
    (CVE-2022-33747)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit     its file-descriptor limit. This causes XAPI to be unable to accept new requests for other (trusted)     clients, and blocks XAPI from carrying out any tasks that require the opening of file descriptors.
    (CVE-2022-33749)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest,     xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only     after the request has been finished completely. A request is regarded to be finished only after the guest     has read the response message of the request from the ring page. Thus a guest not reading the response can     cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of     Service (DoS) of xenstored. (CVE-2022-42319)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

  - Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision.
    The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In     64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and     then creates unsigned/signed confusion in the remainder. This in turn can feed a negative value into logic     not expecting a negative value, resulting in unexpected exceptions being thrown. The unexpected exception     is not handled suitably, creating a busy-loop trying (and failing) to take the bad packet out of the     xenstore ring. (CVE-2022-42324)

  - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In     case a node has been created in a transaction and it is later deleted in the same transaction, the     transaction will be terminated with an error. As this error is encountered only when handling the deleted     node at transaction finalization, the transaction will have been performed partially and without updating     the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
    (CVE-2022-42325, CVE-2022-42326)

  - x86: unintended memory sharing between guests On Intel systems that support the virtualize APIC accesses     feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC     mode. Access to this shared page bypasses the expected isolation that should exist between two guests.
    (CVE-2022-42327)

  - Guests can cause Xenstore crash via soft reset When a guest issues a Soft Reset (e.g. for performing a     kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug     in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same     impact. (CVE-2022-42330)

  - x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original     Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late.
    In some configurations, there is an unprotected RET instruction which can be attacked with a variety of     speculative attacks. (CVE-2022-42331)

  - x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is     necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode.
    Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data     structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The     data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to     keep error handling efforts within reasonable bounds, for operations which may require memory allocations     shadow mode logic ensures up front that enough memory is available for the worst case requirements.
    Unfortunately, while page table memory is properly accounted for on the code path requiring the potential     establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As     a result, just established shadow page tables could be freed again immediately, while other code is still     accessing them on the assumption that they would remain allocated. (CVE-2022-42332)

  - x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the     text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM     guests with passed through devices, an interface exists to explicitly override defaults which would     otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically     exists for domains controlling such guests. This interface may therefore be used by not fully privileged     entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this     exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), -     installation and removal of such regions was not properly serialized (CVE-2022-42334). (CVE-2022-42333,     CVE-2022-42334)

  - x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is     necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode.
    Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for     a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially     under guest control. (CVE-2022-42335)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8267 advisory.

    - posix-cpu-timers: Cleanup CPU timers before freeing them during exec (Wander Lairson Costa) [2116968]     {CVE-2022-2585}
    - fix race between exit_itimers() and /proc/pid/timers (Wander Lairson Costa) [2116968] {CVE-2022-2585}
    - ath9k: htc: clean up statistics macros (Jose Ignacio Tornos Martinez) [2084600] {CVE-2022-1679}
    - ath9k: hif_usb: simplify if-if to if-else (Jose Ignacio Tornos Martinez) [2084600] {CVE-2022-1679}
    - ath9k: fix use-after-free in ath9k_hif_usb_rx_cb (Jose Ignacio Tornos Martinez) [2084600]     {CVE-2022-1679}
    - x86/speculation: Add LFENCE to RSB fill sequence (Waiman Long) [2115086] {CVE-2022-26373}
    - x86/speculation: Add RSB VM Exit protections (Waiman Long) [2115086] {CVE-2022-26373}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7337 advisory.

    - debug: lock down kgdb [Orabug: 34270798] {CVE-2022-21499}
    - x86/speculation: Add LFENCE to RSB fill sequence (Rafael Aquini) [2115073] {CVE-2022-26373}
    - x86/speculation: Protect against userspace-userspace spectreRSB (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/speculation: cope with spectre_v2=retpoline cmdline on retbleed-affected Intel CPUs (Rafael Aquini)     [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/speculation: Disable RRSBA behavior (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/kexec: Disable RET on kexec (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpu/amd: Enumerate BTC_NO (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/common: Stamp out the stepping madness (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/cpu/amd: Add Spectral Chicken (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Do IBPB fallback check only once (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Add retbleed=ibpb (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/bugs: Report Intel retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Enable STIBP for JMP2RET (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Add AMD retbleed= boot parameter (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/bugs: Report AMD retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86: Add magic AMD return-thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86: Use return-thunk in asm code (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/sev: Avoid using __x86_return_thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: Fix SETcc emulation for return thunks (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86,objtool: Create .return_sites (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86: Undo return-thunk damage (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900     CVE-2022-29901}
    - x86/retpoline: Use -mfunction-return (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Move RETPOLINE flags to word 11 (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - objtool: Add ELF writing capability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86: Prepare asm files for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86: Prepare inline-asm for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: Fix fastop function ELF metadata (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - x86/kvm: Move kvm_fastop_exception to .fixup section (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/vdso: Fix vDSO build if a retpoline is emitted (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Carve out CQM features retrieval (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeatures: Re-tabulate the X86_FEATURE definitions (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpufeature: Move processor tracing out of scattered features (Rafael Aquini) [2090227]     {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 (Rafael Aquini) [2090227] {CVE-2022-23816     CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
    - x86/alternatives: Cleanup DPRINTK macro (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825     CVE-2022-29900 CVE-2022-29901}
    - net_sched: cls_route: remove from list when handle is 0 (Davide Caratti) [2121809] {CVE-2022-2588}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9709 advisory.

    - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug:
    34480880]  {CVE-2022-2588}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Paolo Bonzini)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Thadeu Lima de Souza Cascardo)  [Orabug:
    34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt (Alexandre Chartre)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Disable RRSBA behavior (Pawan Gupta)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/exec: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM/VMX: Use TEST %REG,%REG instead of CMP     /u03/ksharma/errata_processing/work/el7uek6/db_7uek6.ELSA-2022-9709,%REG in vmenter.S (Uros Bizjak)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw (Uros Bizjak)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - kbuild/objtool: Add objtool-vmlinux.o pass (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra     (Intel))  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vmlinux: Use INT3 instead of NOP for linker fill bytes (Kees Cook)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/realmode: build with __DISABLE_EXPORTS (Ankur Arora)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bpf: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: elide references to .discard.* from .return_sites (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Support not-feature (Juergen Gross)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/features: Move RETPOLINE flags to word 11 (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Classify symbols (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Create reloc sections implicitly (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add elf_create_reloc() helper (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rework the elf_rebuild_reloc_section() logic (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Handle per arch retpoline naming (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Correctly handle retpoline thunk calls (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Support retpoline jump detection for vmlinux.o (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add 'alt_group' struct (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Clean up elf_write() condition (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add support for relocations without addends (Matt Helsley)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Rename rela to reloc (Matt Helsley)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: optimize add_dead_ends for split sections (Sami Tolvanen)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Move the IRET hack into the arch decoder (Miroslav Benes)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename elf_read() to elf_open_read() (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Constify 'struct elf *' parameters (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize !vmlinux.o again (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Better handle IRET (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/unwind_hints: define unwind_hint_save, unwind_hint_restore (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add abstraction for destination offsets (Raphael Gault)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Fix off-by-one in symbol_by_offset() (Julien Thierry)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_rela_by_dest_range() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize read_sections() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename find_containing_func() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_*() and read_symbols() (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_section_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_section_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add a statistics mode (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn_all() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Introduce validate_return() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Improve call destination function detection (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Fix clang switch table edge case (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add relocation check for alternative sections (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add is_static_jump() helper (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug: 34400675]     {CVE-2022-21505}
    - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly     Kuznetsov)  [Orabug: 34323859]  {CVE-2022-2153}
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug:
    34323859]  {CVE-2022-2153}
    - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323859]     {CVE-2022-2153}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9710 advisory.

    - net_sched: cls_route: remove from list when handle is 0 (Thadeu Lima de Souza Cascardo)  [Orabug:
    34480880]  {CVE-2022-2588}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: emulate: do not adjust size of fastop and setcc subroutines (Paolo Bonzini)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Thadeu Lima de Souza Cascardo)  [Orabug:
    34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt (Alexandre Chartre)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Disable RRSBA behavior (Pawan Gupta)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/exec: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM/VMX: Use TEST %REG,%REG instead of CMP     /u03/ksharma/errata_processing/work/el7uek6/db_7uek6.ELSA-2022-9710,%REG in vmenter.S (Uros Bizjak)     [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw (Uros Bizjak)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - kbuild/objtool: Add objtool-vmlinux.o pass (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra     (Intel))  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vmlinux: Use INT3 instead of NOP for linker fill bytes (Kees Cook)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/realmode: build with __DISABLE_EXPORTS (Ankur Arora)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bpf: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Alternative RET encoding (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: elide references to .discard.* from .return_sites (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Support not-feature (Juergen Gross)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra (Intel))  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/features: Move RETPOLINE flags to word 11 (Peter Zijlstra (Intel))  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Classify symbols (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Create reloc sections implicitly (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add elf_create_reloc() helper (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rework the elf_rebuild_reloc_section() logic (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Handle per arch retpoline naming (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Correctly handle retpoline thunk calls (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Support retpoline jump detection for vmlinux.o (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add 'alt_group' struct (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Clean up elf_write() condition (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add support for relocations without addends (Matt Helsley)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Rename rela to reloc (Matt Helsley)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: optimize add_dead_ends for split sections (Sami Tolvanen)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Move the IRET hack into the arch decoder (Miroslav Benes)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename elf_read() to elf_open_read() (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Constify 'struct elf *' parameters (Ingo Molnar)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize !vmlinux.o again (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Better handle IRET (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/unwind_hints: define unwind_hint_save, unwind_hint_restore (Ankur Arora)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add abstraction for destination offsets (Raphael Gault)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Fix off-by-one in symbol_by_offset() (Julien Thierry)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_rela_by_dest_range() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize read_sections() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename find_containing_func() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_symbol_*() and read_symbols() (Peter Zijlstra)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_section_by_name() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Optimize find_section_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add a statistics mode (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Optimize find_symbol_by_index() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn_all() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Rename func_for_each_insn() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Introduce validate_return() (Peter Zijlstra)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Improve call destination function detection (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Fix clang switch table edge case (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add relocation check for alternative sections (Josh Poimboeuf)  [Orabug: 34335632]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Add is_static_jump() helper (Josh Poimboeuf)  [Orabug: 34335632]  {CVE-2022-29901}     {CVE-2022-23816}
    - lockdown: Fix kexec lockdown bypass with ima policy (Eric Snowberg)  [Orabug: 34400675]     {CVE-2022-21505}
    - KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() (Vitaly     Kuznetsov)  [Orabug: 34323859]  {CVE-2022-2153}
    - KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq (Vitaly Kuznetsov)  [Orabug:
    34323859]  {CVE-2022-2153}
    - KVM: Add infrastructure and macro to mark VM as bugged (Sean Christopherson)  [Orabug: 34323859]     {CVE-2022-2153}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c69ef9c1dd advisory.

    The 5.18.11 stable kernel update contains a number of important fixes across the tree. In addition to the     5.18.11 stable patches, this build contains the retbleed patches scheduled for 5.18.12 kernels.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9591 advisory.

    - floppy: use a statically allocated error counter (Willy Tarreau)  [Orabug: 34218638]  {CVE-2022-1652}
    - x86: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit (Josh Poimboeuf)  [Orabug:
    34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Update Retpoline validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra)     [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bugs: Report AMD retbleed vulnerability (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Add magic AMD return-thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - objtool: Treat .text.__x86.* as noinstr (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Use return-thunk in asm code (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/bpf: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/ftrace: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86,static_call: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86,objtool: Create .return_sites (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Undo return-thunk damage (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/kvm/vmx: Make noinstr clean (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Remove skip_r11rcx (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Fix register corruption in compat syscall (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/entry: Use PUSH_AND_CLEAR_REGS for compat (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/entry: Simplify entry_INT80_compat() (Linus Torvalds)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816} {CVE-2022-29901}
    - x86,static_call: Fix __static_call_return0 for i386 (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - objtool: Default ignore INT3 for unreachable (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-23816} {CVE-2022-29901}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - x86/alternative: Relax text_poke_bp() constraint (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}
    - static_call,x86: Robustify trampoline patching (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-23816}     {CVE-2022-29901}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9590 advisory.

    - floppy: use a statically allocated error counter (Willy Tarreau)  [Orabug: 34218638]  {CVE-2022-1652}
    - x86: Disable RET on kexec (Konrad Rzeszutek Wilk)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: do not enable IBPB-on-entry when IBPB is not supported (Thadeu Lima de Souza Cascardo)     [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - arm64: proton-pack: provide vulnerability file value for RETBleed (James Morse)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Enumerate BTC_NO (Andrew Cooper)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/common: Stamp out the stepping madness (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent RSB underflow before vmenter (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Fix IBRS handling after vmexit (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - KVM: VMX: Convert launched argument to flags (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - KVM: VMX: Flatten __vmx_vcpu_run() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Remove x86_spec_ctrl_mask (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit (Josh Poimboeuf)  [Orabug:
    34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix SPEC_CTRL write on SMT state change (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix firmware entry SPEC_CTRL handling (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/cpu/amd: Add Spectral Chicken (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add entry UNRET validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Do IBPB fallback check only once (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Add retbleed=ibpb (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/xen: Rename SYS* entry points (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Update Retpoline validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - intel_idle: Disable IBRS during long idle (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report Intel retbleed vulnerability (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() (Peter Zijlstra)     [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS (Pawan Gupta)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Optimize SPEC_CTRL MSR writes (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Add kernel IBRS implementation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Enable STIBP for JMP2RET (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/bugs: Add AMD retbleed= boot parameter (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bugs: Report AMD retbleed vulnerability (Alexandre Chartre)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Add magic AMD return-thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Treat .text.__x86.* as noinstr (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Use return-thunk in asm code (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/sev: Avoid using __x86_return_thunk (Kim Phillips)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/kvm: Fix SETcc emulation for return thunks (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/bpf: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ftrace: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,static_call: Use alternative RET encoding (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86,objtool: Create .return_sites (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Undo return-thunk damage (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/retpoline: Use -mfunction-return (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Swizzle retpoline thunk (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/retpoline: Cleanup some #ifdefery (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/kvm/vmx: Make noinstr clean (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Remove skip_r11rcx (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Fix register corruption in compat syscall (Josh Poimboeuf)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/entry: Use PUSH_AND_CLEAR_REGS for compat (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/entry: Simplify entry_INT80_compat() (Linus Torvalds)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/mm: Simplify RESERVE_BRK() (Josh Poimboeuf)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - crypto: x86/poly1305 - Fixup SLS (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901} {CVE-2022-23816}
    - x86,static_call: Fix __static_call_return0 for i386 (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - kvm/emulate: Fix SETcc emulation function offsets with SLS (Borislav Petkov)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - objtool: Default ignore INT3 for unreachable (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Add straight-line-speculation mitigation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - objtool: Add straight-line-speculation validation (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86: Prepare inline-asm for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86: Prepare asm files for straight-line-speculation (Peter Zijlstra)  [Orabug: 34335631]     {CVE-2022-29901} {CVE-2022-23816}
    - x86/lib/atomic64_386_32: Rename things (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - x86/alternative: Relax text_poke_bp() constraint (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}
    - static_call,x86: Robustify trampoline patching (Peter Zijlstra)  [Orabug: 34335631]  {CVE-2022-29901}     {CVE-2022-23816}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208564	CentOS 7 : kernel (RHSA-2022:7337)	Nessus	CentOS Local Security Checks	high
203263	Photon OS 4.0: Linux PHSA-2022-4.0-0248	Nessus	PhotonOS Local Security Checks	high
200470	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2024-12433)	Nessus	Oracle Linux Local Security Checks	medium
199273	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196163	RHEL 6 : hw (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
192466	VMware ESXi 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2022-0020)	Nessus	Misc.	medium
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	critical
189976	GLSA-202402-07 : Xen: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
187326	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)	Nessus	NewStart CGSL Local Security Checks	high
173106	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-070)	Nessus	Amazon Linux Local Security Checks	high
168085	Oracle Linux 9 : kernel (ELSA-2022-8267)	Nessus	Oracle Linux Local Security Checks	high
166937	Oracle Linux 7 : kernel (ELSA-2022-7337)	Nessus	Oracle Linux Local Security Checks	high
166553	Oracle Linux 8 : kernel (ELSA-2022-7110)	Nessus	Oracle Linux Local Security Checks	high
164141	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2022-9709)	Nessus	Oracle Linux Local Security Checks	high
164136	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9710)	Nessus	Oracle Linux Local Security Checks	high
163090	Fedora 36 : kernel (2022-c69ef9c1dd)	Nessus	Fedora Local Security Checks	medium
163037	Oracle Linux 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9591)	Nessus	Oracle Linux Local Security Checks	high
163036	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2022-9590)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2022-23816

No Score

Tenable Plugins

high

high

medium

critical

medium

medium

critical

high

high

high

high

high

high

high

high

medium

high

high