An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.

The version of hyperv-daemons installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-47940 advisory.

  - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c     lacks length validation in the non-padding case in smb2_write. (CVE-2022-47940)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5877-1 advisory.

    Kyle Zeng discovered that the sysctl implementation in the Linux kernel contained a stack-based buffer     overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary     code. (CVE-2022-4378)

    Tams Koczka discovered that the Bluetooth L2CAP handshake implementation in the Linux kernel contained     multiple use-after-free vulnerabilities. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-42896)

    Mingwei Zhang discovered that the KVM implementation for AMD processors in the Linux kernel did not     properly handle cache coherency with Secure Encrypted Virtualization (SEV). A local attacker could     possibly use this to cause a denial of service (host system crash). (CVE-2022-0171)

    It was discovered that a race condition existed in the Android Binder IPC subsystem in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-20421)

    David Leadbeater discovered that the netfilter IRC protocol tracking implementation in the Linux Kernel     incorrectly handled certain message payloads in some situations. A remote attacker could possibly use this     to cause a denial of service or bypass firewall filtering. (CVE-2022-2663)

    It was discovered that the Intel 740 frame buffer driver in the Linux kernel contained a divide by zero     vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2022-3061)

    It was discovered that the sound subsystem in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

    It was discovered that a memory leak existed in the Unix domain socket implementation of the Linux kernel.
    A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2022-3543)

    Gwnaun Jung discovered that the SFB packet scheduling implementation in the Linux kernel contained a use-     after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-3586)

    It was discovered that the Bluetooth HCI implementation in the Linux kernel did not properly deallocate     memory in some situations. An attacker could possibly use this cause a denial of service (memory     exhaustion). (CVE-2022-3619)

    It was discovered that the hugetlb implementation in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2022-3623)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2022-3640)

    It was discovered that the Xen netback driver in the Linux kernel did not properly handle packets     structured in certain ways. An attacker in a guest VM could possibly use this to cause a denial of service     (host NIC availability). (CVE-2022-3643)

    It was discovered that the NILFS2 file system implementation in the Linux kernel did not properly     deallocate memory in certain error conditions. An attacker could use this to cause a denial of service     (memory exhaustion). (CVE-2022-3646)

    Khalid Masum discovered that the NILFS2 file system implementation in the Linux kernel did not properly     handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-3649)

    Jann Horn discovered a race condition existed in the Linux kernel when unmapping VMAs in certain     situations, resulting in possible use-after-free vulnerabilities. A local attacker could possibly use this     to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-39188)

    Hyunwoo Kim discovered that an integer overflow vulnerability existed in the PXA3xx graphics driver in the     Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2022-39842)

    It was discovered that a race condition existed in the EFI capsule loader driver in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-40307)

    Zheng Wang and Zhuorao Yang discovered that the RealTek RTL8712U wireless driver in the Linux kernel     contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-4095)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    Tams Koczka discovered that the Bluetooth L2CAP implementation in the Linux kernel did not properly     initialize memory in some situations. A physically proximate attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2022-42895)

    It was discovered that the USB monitoring (usbmon) component in the Linux kernel did not properly set     permissions on memory mapped in to user space processes. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-43750)

    It was discovered that an integer overflow vulnerability existed in the Bluetooth subsystem in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2022-45934)

    It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset     events. A local attacker with physical access could plug in a specially crafted USB device to cause a     denial of service (kernel deadlock). (CVE-2022-4662)

    Arnaud Gatignol, Quentin Minster, Florent Saudel and Guillaume Teissier discovered that the KSMBD     implementation in the Linux kernel did not properly validate user-supplied data in some situations. An     authenticated attacker could use this to cause a denial of service (system crash), expose sensitive     information (kernel memory) or possibly execute arbitrary code. (CVE-2022-47940)

    It was discovered that a race condition existed in the qdisc implementation in the Linux kernel, leading     to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-0590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5876-1 advisory.

    It was discovered that a memory leak existed in the Unix domain socket implementation of the Linux kernel.
    A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2022-3543)

    It was discovered that the Bluetooth HCI implementation in the Linux kernel did not properly deallocate     memory in some situations. An attacker could possibly use this cause a denial of service (memory     exhaustion). (CVE-2022-3619)

    It was discovered that the hugetlb implementation in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2022-3623)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2022-3640)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    Tams Koczka discovered that the Bluetooth L2CAP implementation in the Linux kernel did not properly     initialize memory in some situations. A physically proximate attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2022-42895)

    Arnaud Gatignol, Quentin Minster, Florent Saudel and Guillaume Teissier discovered that the KSMBD     implementation in the Linux kernel did not properly validate user-supplied data in some situations. An     authenticated attacker could use this to cause a denial of service (system crash), expose sensitive     information (kernel memory) or possibly execute arbitrary code. (CVE-2022-47940)

    It was discovered that a race condition existed in the qdisc implementation in the Linux kernel, leading     to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-0590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5860-1 advisory.

    Kyle Zeng discovered that the sysctl implementation in the Linux kernel contained a stack-based buffer     overflow. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary     code. (CVE-2022-4378)

    Tams Koczka discovered that the Bluetooth L2CAP handshake implementation in the Linux kernel contained     multiple use-after-free vulnerabilities. A physically proximate attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-42896)

    It was discovered that a memory leak existed in the Unix domain socket implementation of the Linux kernel.
    A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2022-3543)

    It was discovered that the Bluetooth HCI implementation in the Linux kernel did not properly deallocate     memory in some situations. An attacker could possibly use this cause a denial of service (memory     exhaustion). (CVE-2022-3619)

    It was discovered that the hugetlb implementation in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2022-3623)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2022-3640)

    It was discovered that the Xen netback driver in the Linux kernel did not properly handle packets     structured in certain ways. An attacker in a guest VM could possibly use this to cause a denial of service     (host NIC availability). (CVE-2022-3643)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    Tams Koczka discovered that the Bluetooth L2CAP implementation in the Linux kernel did not properly     initialize memory in some situations. A physically proximate attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2022-42895)

    It was discovered that an integer overflow vulnerability existed in the Bluetooth subsystem in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2022-45934)

    Arnaud Gatignol, Quentin Minster, Florent Saudel and Guillaume Teissier discovered that the KSMBD     implementation in the Linux kernel did not properly validate user-supplied data in some situations. An     authenticated attacker could use this to cause a denial of service (system crash), expose sensitive     information (kernel memory) or possibly execute arbitrary code. (CVE-2022-47940)

    It was discovered that a race condition existed in the qdisc implementation in the Linux kernel, leading     to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-0590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5851-1 advisory.

    It was discovered that a memory leak existed in the Unix domain socket implementation of the Linux kernel.
    A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2022-3543)

    It was discovered that the Bluetooth HCI implementation in the Linux kernel did not properly deallocate     memory in some situations. An attacker could possibly use this cause a denial of service (memory     exhaustion). (CVE-2022-3619)

    It was discovered that the hugetlb implementation in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash) or expose     sensitive information (kernel memory). (CVE-2022-3623)

    It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform     bounds checking in some situations. A physically proximate attacker could use this to craft a malicious     USB device that when inserted, could cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2022-3628)

    It was discovered that a use-after-free vulnerability existed in the Bluetooth stack in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2022-3640)

    It was discovered that a race condition existed in the SMSC UFX USB driver implementation in the Linux     kernel, leading to a use-after-free vulnerability. A physically proximate attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41849)

    It was discovered that a race condition existed in the Roccat HID driver in the Linux kernel, leading to a     use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2022-41850)

    Tams Koczka discovered that the Bluetooth L2CAP implementation in the Linux kernel did not properly     initialize memory in some situations. A physically proximate attacker could possibly use this to expose     sensitive information (kernel memory). (CVE-2022-42895)

    Arnaud Gatignol, Quentin Minster, Florent Saudel and Guillaume Teissier discovered that the KSMBD     implementation in the Linux kernel did not properly validate user-supplied data in some situations. An     authenticated attacker could use this to cause a denial of service (system crash), expose sensitive     information (kernel memory) or possibly execute arbitrary code. (CVE-2022-47940)

    It was discovered that a race condition existed in the qdisc implementation in the Linux kernel, leading     to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-0590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host is running a ksmbd server that is affected by multiple vulnerabilities:

  - An unauthenticated remote code execution vulnerability in the ksmbd component of the Linux kernel.
    (CVE-2022-47939)

  - An authenticated remote code execution vulnerability in the ksmbd component of the Linux kernel.
    (CVE-2022-47942)

  - An unauthenticated remote denial of service vulnerability in the ksmbd component of the Linux     kernel. (CVE-2022-47941)

  - Authenticated denial of service vulnerabilities in the ksmbd component of the Linux kernel.
    (CVE-2022-47938, CVE-2022-47940)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
172843	CBL Mariner 2.0 Security Update: hyperv-daemons (CVE-2022-47940)	Nessus	MarinerOS Local Security Checks	high
171578	Ubuntu 20.04 LTS : Linux kernel (GKE) vulnerabilities (USN-5877-1)	Nessus	Ubuntu Local Security Checks	high
171573	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-5876-1)	Nessus	Ubuntu Local Security Checks	high
171262	Ubuntu 22.04 LTS : Linux kernel (GKE) vulnerabilities (USN-5860-1)	Nessus	Ubuntu Local Security Checks	high
171252	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-5851-1)	Nessus	Ubuntu Local Security Checks	high
169894	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel kmsbd multiple vulnerabilities	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2022-47940

high

Tenable Plugins

high

high

high

high

high

critical