A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:1659 advisory.

  - A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

  - A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel.
    SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result     in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit     56b88b50565cd8b946a2d00b0c83927b7ebb055e (CVE-2023-0266)

  - A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with     capabilities was found in the Linux kernel's OverlayFS subsystem in how a user copies a capable file from     a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges     on the system. (CVE-2023-0386)

  - kpatch: mm/mremap.c: incomplete fix for CVE-2022-41222 (CVE-2023-1476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1659 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

    * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

    * kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386)

    * kpatch: mm/mremap.c: incomplete fix for CVE-2022-41222 (CVE-2023-1476)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
174007	AlmaLinux 8 : kpatch-patch (ALSA-2023:1659)	Nessus	Alma Linux Local Security Checks	high
173925	RHEL 8 : kpatch-patch (RHSA-2023:1659)	Nessus	Red Hat Local Security Checks	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2023-1476

high

Tenable Plugins

high

high

critical