A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3985-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
    - CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
    - CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and     dpaa2_switch_acl_entry_remove() (bsc#1231973).
    - CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
    - CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
    - CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
    - CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
    - CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
    - CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()     (bsc#1232233).
    - CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070).
    - CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
    - CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
    - CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
    - CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too     (bsc#1226797).
    - CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
    - CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING     (bsc#1227437).
    - CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
    - CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB     (bsc#1228709).
    - CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005).
    - CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837).
    - CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
    - CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
    - CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
    - CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).
    - CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor     (bsc#1230715).
    - CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
    - CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).
    - CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).
    - CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
    - CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
    - CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box     (bsc#1231179).
    - CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
    - CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
    - CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
    - CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links     (bsc#1231197).
    - CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6     (bsc#1231200).
    - CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
    - CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).
    - CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
    - CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables     (bsc#1231096).
    - CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
    - CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()     (bsc#1231094).
    - CVE-2024-46848: perf/x86/intel: Limit the period on Haswell (bsc#1231072).
    - CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
    - CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
    - CVE-2024-46855: netfilter: nft_socket: fix sk refcount leaks (bsc#1231085).
    - CVE-2024-46857: net/mlx5: Fix bridge mode operations when there are no VFs (bsc#1231087).
    - CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
    - CVE-2024-47661: drm/amd/display: Avoid overflow from uint32_t to uint8_t (bsc#1231496).
    - CVE-2024-47664: spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware     (bsc#1231442).
    - CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
    - CVE-2024-47672: wifi: iwlwifi: mvm: do not wait for tx queues if firmware is dead (bsc#1231540).
    - CVE-2024-47673: wifi: iwlwifi: mvm: pause TCM when the firmware is stopped (bsc#1231539).
    - CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
    - CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
    - CVE-2024-47685: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (bsc#1231998).
    - CVE-2024-47692: nfsd: return -EINVAL when namelen is 0 (bsc#1231857).
    - CVE-2024-47704: drm/amd/display: Check link_res->hpo_dp_link_enc before using it (bsc#1231944).
    - CVE-2024-47705: block: fix potential invalid pointer dereference in blk_add_partition (bsc#1231872).
    - CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
    - CVE-2024-47707: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (bsc#1231935).
    - CVE-2024-47710: sock_map: Add a cond_resched() in sock_hash_free() (bsc#1232049).
    - CVE-2024-47720: drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func     (bsc#1232043).
    - CVE-2024-47727: x86/tdx: Fix 'in-kernel MMIO' check (bsc#1232116).
    - CVE-2024-47730: crypto: hisilicon/qm - inject error before stopping queue (bsc#1232075).
    - CVE-2024-47738: wifi: mac80211: do not use rate mask for offchannel TX either (bsc#1232114).
    - CVE-2024-47739: padata: use integer wrap around to prevent deadlock on seq_nr overflow (bsc#1232124).
    - CVE-2024-47745: mm: split critical region in remap_file_pages() and invoke LSMs in between     (bsc#1232135).
    - CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition     (bsc#1232145).
    - CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
    - CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
    - CVE-2024-49866: tracing/timerlat: Fix a race during cpuhp processing (bsc#1232259).
    - CVE-2024-49881: ext4: update orig_path in ext4_find_extent() (bsc#1232201).
    - CVE-2024-49882: ext4: fix double brelse() the buffer of the extents path (bsc#1232200).
    - CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() (bsc#1232199).
    - CVE-2024-49886: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (bsc#1232196).
    - CVE-2024-49890: drm/amd/pm: ensure the fw_info is not null before using it (bsc#1232217).
    - CVE-2024-49892: drm/amd/display: Initialize get_bytes_per_element's default to 1 (bsc#1232220).
    - CVE-2024-49894: drm/amd/display: Fix index out of bounds in degamma hardware format translation     (bsc#1232354).
    - CVE-2024-49896: drm/amd/display: Check stream before comparing them (bsc#1232221).
    - CVE-2024-49897: drm/amd/display: Check phantom_stream before it is used (bsc#1232355).
    - CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
    - CVE-2024-49901: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (bsc#1232305).
    - CVE-2024-49906: drm/amd/display: Check null pointer before try to access it (bsc#1232332).
    - CVE-2024-49909: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func     (bsc#1232337).
    - CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func     (bsc#1232366).
    - CVE-2024-49914: drm/amd/display: Add null check for pipe_ctx->plane_state in (bsc#1232369).
    - CVE-2024-49917: drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw     (bsc#1231965).
    - CVE-2024-49918: drm/amd/display: Add null check for head_pipe in     dcn32_acquire_idle_pipe_for_head_pipe_in_layer (bsc#1231967).
    - CVE-2024-49919: drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer     (bsc#1231968).
    - CVE-2024-49920: drm/amd/display: Check null pointers before multiple uses (bsc#1232313).
    - CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
    - CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
    - CVE-2024-49929: wifi: iwlwifi: mvm: avoid NULL pointer dereference (bsc#1232253).
    - CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
    - CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
    - CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
    - CVE-2024-49939: wifi: rtw89: avoid to add interface to list twice when SER (bsc#1232381).
    - CVE-2024-49946: ppp: do not assume bh is held in ppp_channel_bridge_input() (bsc#1232164).
    - CVE-2024-49949: net: avoid potential underflow in qdisc_pkt_len_init() with UFO (bsc#1232160).
    - CVE-2024-49954: static_call: Replace pointless WARN_ON() in static_call_module_notify() (bsc#1232155).
    - CVE-2024-49955: ACPI: battery: Fix possible crash when unregistering a battery hook (bsc#1232154).
    - CVE-2024-49958: ocfs2: reserve space for inline xattr before attaching reflink tree (bsc#1232151).
    - CVE-2024-49959: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error     (bsc#1232149).
    - CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
    - CVE-2024-49962: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()     (bsc#1232314).
    - CVE-2024-49967: ext4: no need to continue when the number of entries is 1 (bsc#1232140).
    - CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
    - CVE-2024-49973: r8169: add tally counter fields added with RTL8125 (bsc#1232105).
    - CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
    - CVE-2024-49975: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1232104).
    - CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
    - CVE-2024-49993: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count (bsc#1232316).
    - CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
    - CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
    - CVE-2024-50000: net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() (bsc#1232085).
    - CVE-2024-50001: net/mlx5: Fix error path in multi-packet WQE transmit (bsc#1232084).
    - CVE-2024-50002: static_call: Handle module init failure correctly in static_call_del_module()     (bsc#1232083).
    - CVE-2024-50006: ext4: fix i_data_sem unlock order in ext4_ind_migrate() (bsc#1232442).
    - CVE-2024-50014: ext4: fix access to uninitialised lock in fc replay path (bsc#1232446).
    - CVE-2024-50019: kthread: unpark only parked kthread (bsc#1231990).
    - CVE-2024-50024: net: Fix an unsafe loop on the list (bsc#1231954).
    - CVE-2024-50028: thermal: core: Reference count the zone in thermal_zone_get_by_id() (bsc#1231950).
    - CVE-2024-50033: slip: make slhc_remember() more robust against malicious packets (bsc#1231914).
    - CVE-2024-50035: ppp: fix ppp_async_encode() illegal access (bsc#1232392).
    - CVE-2024-50041: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash (bsc#1231907).
    - CVE-2024-50045: netfilter: br_netfilter: fix panic with metadata_dst skb (bsc#1231903).
    - CVE-2024-50046: kabi fix for NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()     (bsc#1231902).
    - CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).
    - CVE-2024-50048: fbcon: Fix a NULL pointer dereference issue in fbcon_putcs (bsc#1232310).
    - CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
    - CVE-2024-50058: serial: protect uart_port_dtr_rts() in uart_shutdown() too (bsc#1232285).
    - CVE-2024-50059: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to     race condition (bsc#1232345).
    - CVE-2024-50061: i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to     Race Condition (bsc#1232263).
    - CVE-2024-50063: kABI: bpf: struct bpf_map kABI workaround (bsc#1232435).
    - CVE-2024-50081: blk-mq: setup queue ->tag_set before initializing hctx (bsc#1232501).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3983-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2022-48879: efi: fix NULL-deref in init error path (bsc#1229556).
    - CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1231893).
    - CVE-2022-48957: dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and     dpaa2_switch_acl_entry_remove() (bsc#1231973).
    - CVE-2022-48958: ethernet: aeroflex: fix potential skb leak in greth_init_rings() (bsc#1231889).
    - CVE-2022-48959: net: dsa: sja1105: fix memory leak in sja1105_setup_devlink_regions() (bsc#1231976).
    - CVE-2022-48960: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() (bsc#1231979).
    - CVE-2022-48962: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() (bsc#1232286).
    - CVE-2022-48966: net: mvneta: Fix an out of bounds check (bsc#1232191).
    - CVE-2022-48980: net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()     (bsc#1232233).
    - CVE-2022-48991: mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (bsc#1232070 git-fix     prerequisity).
    - CVE-2022-49015: net: hsr: Fix potential use-after-free (bsc#1231938).
    - CVE-2022-49017: tipc: re-fetch skb cb after tipc_msg_validate (bsc#1232004).
    - CVE-2022-49020: net/9p: Fix a potential socket leak in p9_socket_open (bsc#1232175).
    - CVE-2024-36244: net/sched: taprio: extend minimum interval restriction to entire cycle too     (bsc#1226797).
    - CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
    - CVE-2024-39476: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING     (bsc#1227437).
    - CVE-2024-40965: i2c: lpi2c: Avoid calling clk_get_rate during transfer (bsc#1227885).
    - CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB     (bsc#1228709).
    - CVE-2024-42253: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (bsc#1229005 stable-fixes).
    - CVE-2024-44931: gpio: prevent potential speculation leaks in gpio_device_get_desc() (bsc#1229837 stable-     fixes).
    - CVE-2024-44958: sched/smt: Fix unbalance sched_smt_present dec/inc (bsc#1230179).
    - CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230429).
    - CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (bsc#1230456).
    - CVE-2024-46716: dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor     (bsc#1230715).
    - CVE-2024-46754: bpf: Remove tst_run from lwt_seg6local_prog_ops (bsc#1230801).
    - CVE-2024-46777: udf: Avoid excessive partition lengths (bsc#1230773).
    - CVE-2024-46809: drm/amd/display: Check BIOS images before it is used (bsc#1231148).
    - CVE-2024-46811: drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box     (bsc#1231179).
    - CVE-2024-46813: drm/amd/display: Check link_index before accessing dc->links (bsc#1231191).
    - CVE-2024-46814: drm/amd/display: Check msg_id before processing transcation (bsc#1231193).
    - CVE-2024-46815: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets (bsc#1231195).
    - CVE-2024-46816: drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links     (bsc#1231197).
    - CVE-2024-46817: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6     (bsc#1231200).
    - CVE-2024-46818: drm/amd/display: Check gpio_id before used as array index (bsc#1231203).
    - CVE-2024-46828: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1231114).
    - CVE-2024-46834: ethtool: fail closed if we can't get max channel used in indirection tables     (bsc#1231096).
    - CVE-2024-46840: btrfs: clean up our handling of refs == 0 in snapshot delete (bsc#1231105).
    - CVE-2024-46841: btrfs: do not BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()     (bsc#1231094).
    - CVE-2024-46848: perf/x86/intel: Limit the period on Haswell (bsc#1231072).
    - CVE-2024-46849: ASoC: meson: axg-card: fix 'use-after-free' (bsc#1231073).
    - CVE-2024-47660: fsnotify: clear PARENT_WATCHED flags lazily (bsc#1231439).
    - CVE-2024-47661: drm/amd/display: Avoid overflow from uint32_t to uint8_t (bsc#1231496).
    - CVE-2024-47664: spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmware     (bsc#1231442).
    - CVE-2024-47668: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (bsc#1231502).
    - CVE-2024-47672: wifi: iwlwifi: mvm: do not wait for tx queues if firmware is dead (bsc#1231540).
    - CVE-2024-47673: wifi: iwlwifi: mvm: pause TCM when the firmware is stopped (bsc#1231539).
    - CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231673).
    - CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231987).
    - CVE-2024-47685: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (bsc#1231998).
    - CVE-2024-47692: nfsd: return -EINVAL when namelen is 0 (bsc#1231857).
    - CVE-2024-47704: drm/amd/display: Check link_res->hpo_dp_link_enc before using it (bsc#1231944).
    - CVE-2024-47705: block: fix potential invalid pointer dereference in blk_add_partition (bsc#1231872).
    - CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231942).
    - CVE-2024-47707: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() (bsc#1231935).
    - CVE-2024-47710: sock_map: Add a cond_resched() in sock_hash_free() (bsc#1232049).
    - CVE-2024-47720: drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func     (bsc#1232043).
    - CVE-2024-47727: x86/tdx: Fix 'in-kernel MMIO' check (bsc#1232116).
    - CVE-2024-47730: crypto: hisilicon/qm - inject error before stopping queue (bsc#1232075).
    - CVE-2024-47738: wifi: mac80211: do not use rate mask for offchannel TX either (bsc#1232114).
    - CVE-2024-47739: padata: use integer wrap around to prevent deadlock on seq_nr overflow (bsc#1232124).
    - CVE-2024-47745: mm: split critical region in remap_file_pages() and invoke LSMs in between     (bsc#1232135).
    - CVE-2024-47747: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition     (bsc#1232145).
    - CVE-2024-47748: vhost_vdpa: assign irq bypass producer token correctly (bsc#1232174).
    - CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231861).
    - CVE-2024-49866: tracing/timerlat: Fix a race during cpuhp processing (bsc#1232259).
    - CVE-2024-49881: ext4: update orig_path in ext4_find_extent() (bsc#1232201).
    - CVE-2024-49882: ext4: fix double brelse() the buffer of the extents path (bsc#1232200).
    - CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() (bsc#1232199).
    - CVE-2024-49886: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (bsc#1232196).
    - CVE-2024-49890: drm/amd/pm: ensure the fw_info is not null before using it (bsc#1232217).
    - CVE-2024-49892: drm/amd/display: Initialize get_bytes_per_element's default to 1 (bsc#1232220).
    - CVE-2024-49896: drm/amd/display: Check stream before comparing them (bsc#1232221).
    - CVE-2024-49897: drm/amd/display: Check phantom_stream before it is used (bsc#1232355).
    - CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
    - CVE-2024-49901: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (bsc#1232305).
    - CVE-2024-49906: drm/amd/display: Check null pointer before try to access it (bsc#1232332).
    - CVE-2024-49909: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func     (bsc#1232337).
    - CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func     (bsc#1232366).
    - CVE-2024-49914: drm/amd/display: Add null check for pipe_ctx->plane_state in (bsc#1232369).
    - CVE-2024-49917: drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw     (bsc#1231965).
    - CVE-2024-49918: drm/amd/display: Add null check for head_pipe in     dcn32_acquire_idle_pipe_for_head_pipe_in_layer (bsc#1231967).
    - CVE-2024-49919: drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer     (bsc#1231968).
    - CVE-2024-49920: drm/amd/display: Check null pointers before multiple uses (bsc#1232313).
    - CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
    - CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
    - CVE-2024-49929: wifi: iwlwifi: mvm: avoid NULL pointer dereference (bsc#1232253).
    - CVE-2024-49930: wifi: ath11k: fix array out-of-bound access in SoC stats (bsc#1232260).
    - CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
    - CVE-2024-49936: net/xen-netback: prevent UAF in xenvif_flush_hash() (bsc#1232424).
    - CVE-2024-49939: wifi: rtw89: avoid to add interface to list twice when SER (bsc#1232381).
    - CVE-2024-49946: ppp: do not assume bh is held in ppp_channel_bridge_input() (bsc#1232164).
    - CVE-2024-49949: net: avoid potential underflow in qdisc_pkt_len_init() with UFO (bsc#1232160).
    - CVE-2024-49954: static_call: Replace pointless WARN_ON() in static_call_module_notify() (bsc#1232155).
    - CVE-2024-49955: ACPI: battery: Fix possible crash when unregistering a battery hook (bsc#1232154).
    - CVE-2024-49958: ocfs2: reserve space for inline xattr before attaching reflink tree (bsc#1232151).
    - CVE-2024-49959: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error     (bsc#1232149).
    - CVE-2024-49960: ext4: fix timer use-after-free on failed mount (bsc#1232395).
    - CVE-2024-49967: ext4: no need to continue when the number of entries is 1 (bsc#1232140).
    - CVE-2024-49969: drm/amd/display: Fix index out of bounds in DCN30 color transformation (bsc#1232519).
    - CVE-2024-49973: r8169: add tally counter fields added with RTL8125 (bsc#1232105).
    - CVE-2024-49974: NFSD: Force all NFSv4.2 COPY requests to be synchronous (bsc#1232383).
    - CVE-2024-49975: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1232104).
    - CVE-2024-49991: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (bsc#1232282).
    - CVE-2024-49993: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count (bsc#1232316).
    - CVE-2024-49995: tipc: guard against string buffer overrun (bsc#1232432).
    - CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
    - CVE-2024-50000: net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() (bsc#1232085).
    - CVE-2024-50001: net/mlx5: Fix error path in multi-packet WQE transmit (bsc#1232084).
    - CVE-2024-50002: static_call: Handle module init failure correctly in static_call_del_module()     (bsc#1232083).
    - CVE-2024-50006: ext4: fix i_data_sem unlock order in ext4_ind_migrate() (bsc#1232442).
    - CVE-2024-50014: ext4: fix access to uninitialised lock in fc replay path (bsc#1232446).
    - CVE-2024-50019: kthread: unpark only parked kthread (bsc#1231990).
    - CVE-2024-50024: net: Fix an unsafe loop on the list (bsc#1231954).
    - CVE-2024-50028: thermal: core: Reference count the zone in thermal_zone_get_by_id() (bsc#1231950).
    - CVE-2024-50033: slip: make slhc_remember() more robust against malicious packets (bsc#1231914).
    - CVE-2024-50035: ppp: fix ppp_async_encode() illegal access (bsc#1232392).
    - CVE-2024-50041: i40e: Fix macvlan leak by synchronizing access to mac_filter_hash (bsc#1231907).
    - CVE-2024-50045: netfilter: br_netfilter: fix panic with metadata_dst skb (bsc#1231903).
    - CVE-2024-50046: kabi fix for NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies()     (bsc#1231902).
    - CVE-2024-50047: smb: client: fix UAF in async decryption (bsc#1232418).
    - CVE-2024-50048: fbcon: Fix a NULL pointer dereference issue in fbcon_putcs (bsc#1232310).
    - CVE-2024-50055: driver core: bus: Fix double free in driver API bus_register() (bsc#1232329).
    - CVE-2024-50058: serial: protect uart_port_dtr_rts() in uart_shutdown() too (bsc#1232285).
    - CVE-2024-50059: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to     race condition (bsc#1232345).
    - CVE-2024-50061: i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to     Race Condition (bsc#1232263).
    - CVE-2024-50063: kABI: bpf: struct bpf_map kABI workaround (bsc#1232435).
    - CVE-2024-50081: blk-mq: setup queue ->tag_set before initializing hctx (bsc#1232501).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3528 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

    * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0461 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: vmwgfx: reference count issue leads to use-after-free in surface handling (CVE-2023-5633)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c (CVE-2022-36402)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1404 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (CVE-2021-43975)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: denial of service in tipc_conn_close (CVE-2023-1382)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * The kernel is still getting hung up even after converting kernfs_mutex to kernfs_rwsem with massive     concurrent kernfs access (open & lookup) performed by kubelet/node_exporter threads. (JIRA:RHEL-17149)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (JIRA:RHEL-18810)

    * kernel: tun: avoid double free in tun_free_netdev (JIRA:RHEL-18813)

    * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (JIRA:RHEL-18850)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19461)

    * ipoib mcast lockup fix (JIRA:RHEL-19698)

    * kernel: denial of service in tipc_conn_close (JIRA:RHEL-18824)

    * Rhel-8.6 crash at  qed_get_current_link+0x11 during tx_timeout recovery  (JIRA:RHEL-20923)

    * kernel: use-after-free in sch_qfq network scheduler (JIRA:RHEL-14402)

    * RHEL8.6 - s390/qeth: NET2016 - fix use-after-free in HSCI (JIRA:RHEL-15849)

    * RHEL8.6 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17883)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-18582)

    * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in     drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c (JIRA:RHEL-18799)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (JIRA:RHEL-18814)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-18998)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19110)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19327)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19451)

    * [RHEL8] I/O blocked during fio background with IO schedule switch, cpu offline/online, pci nvme     rescan/reset (JIRA:RHEL-20231)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20298)

    * kernel: inactive elements in nft_pipapo_walk (JIRA:RHEL-20697)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (JIRA:RHEL-21661)

    * kernel NULL pointer at RIP: 0010:kyber_has_work+0x1c/0x60 (JIRA:RHEL-21784)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22090)

    * backport timerlat user-space support (JIRA:RHEL-20361)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1382 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead     (CVE-2023-3611)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

    * inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * out-of-bounds write in qfq_change_class function (JIRA:RHEL-12700)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18192)

    * refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20302)

    * inactive elements in nft_pipapo_walk (JIRA:RHEL-20703)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (JIRA:RHEL-22099)

    * update RT source tree to the latest RHEL-8.4.z Batch 23 (JIRA:RHEL-23825)

    * null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-19023)

    * Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19404)

    * A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19530)

    * vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22755)

    * NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19520)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1367 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * kernel: out-of-bounds write in qfq_change_class function (JIRA:RHEL-12696)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18194)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20296)

    * kernel: inactive elements in nft_pipapo_walk (JIRA:RHEL-20695)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22088)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (JIRA:RHEL-18580)

    * ipoib mcast lockup fix (JIRA:RHEL-19696)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19108)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19325)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19449)

    * kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22763)

    * RHEL 8.5: Backport upstream memory cgroup commits up to v5.12 (JIRA:RHEL-9162)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19459)

    * ceph: several cap and snap fixes (JIRA:RHEL-20906)

    * kernel NULL pointer at RIP: 0010:kyber_has_work+0x1c/0x60 (JIRA:RHEL-21782)

    * rbd: don't move requests to the running list on errors [8.x] (JIRA:RHEL-24201)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1306 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch     requests (CVE-2023-3390)

    * out-of-bounds access in relay_file_read (CVE-2023-3268)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (CVE-2023-38409)

    * Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue ()

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * use after free in unix_stream_sendpage (CVE-2023-4622)

    * bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its     child's sibling_list (CVE-2023-5717)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (CVE-2024-0646)

    * use-after-free in IPv4 IGMP (CVE-2023-6932)

    * GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

    * refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment (JIRA:RHEL-1107)

    * out-of-bounds access in relay_file_read (JIRA:RHEL-1749)

    * vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18085)

    * NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19524)

    * update RT source tree to the latest RHEL-9.0.z Batch 15 (JIRA:RHEL-21555)

    * Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-9285)

    * A heap out-of-bounds write (JIRA:RHEL-18011)

    * Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19398)

    * A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19534)

    * Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe (JIRA:RHEL-8980)

    * various flaws (JIRA:RHEL-16150)

    * refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20311)

    * use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-20502)

    * ktls overwrites readonly memory pages when using function splice with a ktls socket as destination     (JIRA:RHEL-22095)

    * use-after-free in smb2_is_status_io_timeout() (JIRA:RHEL-15171)

    * use-after-free in IPv4 IGMP (JIRA:RHEL-21658)

    * memcg does not limit the number of POSIX file locks allowing memory exhaustion (JIRA:RHEL-8996)

    * GSM multiplexing race condition leads to privilege escalation (JIRA:RHEL-19968)

    * NULL pointer dereference in vmw_cmd_dx_define_query (JIRA:RHEL-22751)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier     (JIRA:RHEL-26381)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1250 advisory.

    Security Fix(es):

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (CVE-2023-4459)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982,Downfall)

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue ()

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

    * kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

    Bug Fix(es):

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (JIRA:RHEL-1104)

    * [SanityOnly][kernel]BUG: sleeping function called from invalid context at     kernel/locking/spinlock_rt.c:35 at: sock_map_update_elem_sys+0x85/0x2a0 (JIRA:RHEL-17572)

    * kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() (JIRA:RHEL-18084)

    * kernel: NULL pointer dereference in can_rcv_filter (JIRA:RHEL-19463)

    * kernel: hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (JIRA:RHEL-8592)

    * kernel: A heap out-of-bounds write (JIRA:RHEL-18008)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (JIRA:RHEL-19356)

    * kernel: A flaw leading to a use-after-free in area_cache_get() (JIRA:RHEL-19454)

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (JIRA:RHEL-8978)

    * kernel: use-after-free in smb2_is_status_io_timeout() (JIRA:RHEL-15167)

    * kernel: various flaws (JIRA:RHEL-16148)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-19001)

    * kernel: refcount leak in ctnetlink_create_conntrack() (JIRA:RHEL-20307)

    * RHEL9.0 - s390/qeth: recovery and set offline lose routes and IPv6 addr (JIRA:RHEL-17885)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (JIRA:RHEL-22092)

    * dm multipath device suspend deadlocks waiting on a flush request (JIRA:RHEL-19103)

    * 5.14.0-70.87.1.el9_0: aarch64 BUG: arch topology borken / the CLS domain not a subset of the MC domain     (JIRA:RHEL-22501)

    * RHEL-9.0 TEST-17-Setup-struct-perf-event-attr / bz1308907 test failure on Ice Lake (JIRA:RHEL-23085)

    * Unbounded memory usage by TCP for receive buffers (JIRA:RHEL-16127)

    * kernel: use-after-free in IPv4 IGMP (JIRA:RHEL-21648)

    * rbd: don't move requests to the running list on errors (JIRA:RHEL-23861)

    * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: vmxgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0461 advisory.

    - nfp: fix use-after-free in area_cache_get() (Ricardo Robaina) [RHEL-19456 RHEL-19536 RHEL-6566     RHEL-7241] {CVE-2022-3545}
    - fbcon: set_con2fb_map needs to set con2fb_map! (Jocelyn Falempe) [RHEL-1106 RHEL-1109 RHEL-12930     RHEL-13899] {CVE-2023-38409}
    - fbcon: Fix error paths in set_con2fb_map (Jocelyn Falempe) [RHEL-1106 RHEL-1109 RHEL-12930 RHEL-13899]     {CVE-2023-38409}
    - net: tun: fix bugs for oversize packet when napi frags enabled (Ricardo Robaina) [RHEL-12495 RHEL-12496     RHEL-7186 RHEL-7264] {CVE-2023-3812}
    - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Florian Westphal) [RHEL-10536     RHEL-10538 RHEL-10537 RHEL-10539] {CVE-2023-4015}
    - dpll: sanitize possible null pointer dereference in dpll_pin_parent_pin_set() (Michal Schmidt)     [RHEL-19677 RHEL-19095] {CVE-2023-6679}
    - dpll: Fix potential msg memleak when genlmsg_put_reply failed (Michal Schmidt) [RHEL-19677 RHEL-19095]     {CVE-2023-6679}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Bastien Nocera) [RHEL-19003 RHEL-2717]     {CVE-2023-40283}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0897 advisory.

    - net: tls, update curr on splice as well (Sabrina Dubroca) [RHEL-22091 RHEL-19065] {CVE-2024-0646}
    - smb: client: fix potential OOB in smb2_dump_detail() (Scott Mayhew) [RHEL-21672 RHEL-19144]     {CVE-2023-6610}
    - smb: client: fix potential OOB in cifs_dump_detail() (Scott Mayhew) [RHEL-21672 RHEL-19144]     {CVE-2023-6610}
    - nvmet-tcp: Fix the H2C expected PDU len calculation (Maurizio Lombardi) [RHEL-22299 RHEL-22637     RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
    - nvmet-tcp: remove boilerplate code (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155     RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
    - nvmet-tcp: fix a crash in nvmet_req_complete() (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641     RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length (Maurizio Lombardi) [RHEL-22299     RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
    - netfilter: nft_set_pipapo: skip inactive elements during set walk (Florian Westphal) [RHEL-20698     RHEL-19721] {CVE-2023-6817}
    - smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-21662 RHEL-18990] {CVE-2023-6606}
    - HID: check empty report_list in hid_validate_values() (Desnes Nunes) [RHEL-19274 RHEL-19237]     {CVE-2023-1073}
    - x86/sev: Check for user-space IOIO pointing to kernel space (Wander Lairson Costa) [RHEL-18014     RHEL-14978] {CVE-2023-46813}
    - x86/sev: Check IOBM for IOIO exceptions from user-space (Wander Lairson Costa) [RHEL-18014 RHEL-14978]     {CVE-2023-46813}
    - x86/sev: Disable MMIO emulation from user mode (Wander Lairson Costa) [RHEL-18014 RHEL-14978]     {CVE-2023-46813}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-378.el9 build changelog.

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating     `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since     `skb_shared_info` contains references to function pointers. (CVE-2023-42752)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12169 advisory.

    - drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
    - nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
    - HID: check empty report_list in hid_validate_values() {CVE-2023-1073}
    - Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
    - can: af_can: fix NULL pointer dereference in can_rcv_filter {CVE-2023-2166}
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
    - perf: Disallow mis-matched inherited group reads {CVE-2023-5717}
    - perf/core: Fix potential NULL deref {CVE-2023-5717}
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6536 CVE-2023-6535     CVE-2023-6356}
    - nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - nvmet-tcp: remove boilerplate code {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
    - smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
    - smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
    - net: tls, update curr on splice as well {CVE-2024-0646}
    - netfilter: nft_set_pipapo: skip inactive elements during set walk {CVE-2023-6817}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0897 advisory.

  - A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability. (CVE-2022-3545)

  - A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

  - A memory corruption flaw was found in the Linux kernel's human interface device (HID) subsystem in how a     user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2023-1073)

  - A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem. (CVE-2023-1838)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux     Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem     to crash the system or escalation of privilege. (CVE-2023-2176)

  - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before     6.4.10. There is a use-after-free because the children of an sk are mishandled. (CVE-2023-40283)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an     event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory     locations outside of the allocated buffer. We recommend upgrading past commit     32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

  - A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver and causing kernel panic and a denial of service. (CVE-2023-6356)

  - A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver, causing kernel panic and a denial of service. (CVE-2023-6535,     CVE-2023-6536)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6610)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set     walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-     after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

  - An out-of-bounds memory write flaw was found in the Linux kernel's Transport Layer Security functionality     in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2024-0646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0881 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0897 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0724 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * kernel: improper input validation may lead to privilege escalation (CVE-2021-4204)

    * kernel: memory leak for large arguments in video_usercopy function in     drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

    * kernel: eBPF verification flaw (CVE-2021-34866)

    * kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges     (CVE-2022-0500)

    * kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * kernel: possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    * kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

    * kernel: netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * kernel: memory leak in ipv6_renew_options() (CVE-2022-3524)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed     (CVE-2022-3707)

    * kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * kernel: local privileges escalation in kernel/bpf/verifier.c (CVE-2022-23222)

    * kernel: Executable Space Protection Bypass (CVE-2022-25265)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12094 advisory.

    - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
    - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858}
    - can: af_can: fix NULL pointer dereference in can_rcv_filter (Oliver Hartkopp) {CVE-2023-2166}
    - RDMA/core: Fix resolve_prepare_src error cleanup (Patrisious Haddad) {CVE-2023-2176}
    - netfilter: nf_tables: skip bound chain on rule flush (Pablo Neira Ayuso} {CVE-2023-3777}
    - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
    - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Pablo Neira Ayuso) {CVE-2023-4015}
    - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima) {CVE-2023-4622}
    - nvmet-tcp: Fix a possible UAF in queue intialization setup (Sagi Grimberg) {CVE-2023-5178}
    - fbcon: set_con2fb_map needs to set con2fb_map! (Daniel Vetter) {CVE-2023-38409}
    - fbcon: Fix error paths in set_con2fb_map (Daniel Vetter) {CVE-2023-38409}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) {CVE-2023-40283)
    - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng)     {CVE-2023-42753}
    - x86/sev: Check IOBM for IOIO exceptions from user-space (Joerg Roedel) {CVE-2023-46813}
    - x86/sev: Disable MMIO emulation from user mode (Borislav Petkov) {CVE-2023-46813}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0439 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue (BZ#2230094)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

    * kernel: A heap out-of-bounds write (CVE-2023-5717)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0448 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

    * kernel: A heap out-of-bounds write (CVE-2023-5717)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * sev-guest is not loaded automatically in the guest kernel when sev-snp is enabled (BZ#2218934)

    * Cgroups v2: Current interface to disable cpu load balancing not compatible with kubernetes cgroup     hierarchy (BZ#2238754)

    * WPC ice driver misc irq not getting generated for a interface. (BZ#2245881)

    * RHEL9.0 - s390/qeth: NET2016 - fix use-after-free in HSCI (BZ#2247798)

    * pNFS/filelayout: treat GETDEVICEINFO errors as layout failure (BZ#2249557)

    * cifs: fix dentry lookups in directory handle cache (BZ#2249558)

    * Performance regression with random 2 KiB writes to ext4 filesystem with 4 KiB filesystem blocks     (BZ#2249685)

    * kernel.spec: Fix UKI naming to comply with BLS (BZ#2254546)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3377-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3376-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3318-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service problem. (CVE-2023-2985)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - ** REJECT ** Duplicate of CVE-2023-3390. (CVE-2023-3117)

  - Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3313-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3302-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root.
    We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c     in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service     threat. (CVE-2023-2430)

  - A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service problem. (CVE-2023-2985)

  - A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in     the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend     upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

  - ** REJECT ** Duplicate of CVE-2023-3390. (CVE-2023-3117)

  - Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()`     failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace     (CVE-2023-31248)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a     hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for     5.15 stable). (CVE-2023-3389)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An out-of-bounds memory access flaw was found in the Linux kernel's TUN/TAP device driver functionality in     how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows     a local user to crash or potentially escalate their privileges on the system. (CVE-2023-3812)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3311-1 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec     allowing a user to bypass the access_ok check and pass a kernel pointer to copy_from_user(). This would     allow an attacker to leak information. We recommend upgrading beyond commit     74e19ef0ff8061ef55957c3abd71614ef0f42f47 (CVE-2023-0459)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

  - In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.
    This could lead to local escalation of privilege in the kernel with System execution privileges needed.
    User interaction is not needed for exploitation. (CVE-2023-21400)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

  - An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl,     there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before     hu->proto is set. A NULL pointer dereference may occur. (CVE-2023-31083)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

  - A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux     Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal     kernel information. (CVE-2023-3567)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before     6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display     arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info).
    (CVE-2023-38409)

  - A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel.
    This flaw allows a local user with special privileges to impact a kernel information leak issue.
    (CVE-2023-3863)

  - A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the     nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local     user to crash the system or potentially escalate their privileges on the system. (CVE-2023-4004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.162-141.675. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-025 advisory.

  - Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC     interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It     appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol     headers are all contained within the linear section of the SKB and some NICs behave badly if this is not     the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x)     though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with     split headers, netback will forward those violating above mentioned assumption to the networking core,     resulting in said misbehavior. (CVE-2022-3643)

  - A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability. (CVE-2022-3435)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

  - Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42328, CVE-2022-42329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.228-131.415. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-041 advisory.

  - Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC     interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It     appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol     headers are all contained within the linear section of the SKB and some NICs behave badly if this is not     the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x)     though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with     split headers, netback will forward those violating above mentioned assumption to the networking core,     resulting in said misbehavior. (CVE-2022-3643)

  - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability. (CVE-2022-3623)

  - Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs;
    the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced     another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the     XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock     could occur in case of netpoll being active for the interface the xen-netback driver is connected to     (CVE-2022-42329). (CVE-2022-42328, CVE-2022-42329)

  - A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.
    ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to     crash the system or potentially cause a denial of service. (CVE-2023-2166)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210938	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:3985-1)	Nessus	SuSE Local Security Checks	critical
210933	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:3983-1)	Nessus	SuSE Local Security Checks	critical
198297	RHEL 8 : kernel (RHSA-2024:3528)	Nessus	Red Hat Local Security Checks	high
194405	RHEL 9 : kernel (RHSA-2024:0461)	Nessus	Red Hat Local Security Checks	high
192277	RHEL 8 : kernel (RHSA-2024:1404)	Nessus	Red Hat Local Security Checks	high
192263	RHEL 8 : kernel-rt (RHSA-2024:1382)	Nessus	Red Hat Local Security Checks	high
192229	RHEL 8 : kernel (RHSA-2024:1367)	Nessus	Red Hat Local Security Checks	high
192035	RHEL 9 : kernel-rt (RHSA-2024:1306)	Nessus	Red Hat Local Security Checks	high
191901	RHEL 9 : kernel (RHSA-2024:1250)	Nessus	Red Hat Local Security Checks	high
191728	Oracle Linux 9 : kernel (ELSA-2024-0461)	Nessus	Oracle Linux Local Security Checks	high
191697	Oracle Linux 8 : kernel (ELSA-2024-0897)	Nessus	Oracle Linux Local Security Checks	high
191337	CentOS 9 : kernel-5.14.0-378.el9	Nessus	CentOS Local Security Checks	medium
190914	Oracle Linux 8 : kernel (ELSA-2024-12169)	Nessus	Oracle Linux Local Security Checks	high
190904	AlmaLinux 8 : kernel (ALSA-2024:0897)	Nessus	Alma Linux Local Security Checks	high
190771	RHEL 8 : kernel-rt (RHSA-2024:0881)	Nessus	Red Hat Local Security Checks	high
190769	RHEL 8 : kernel (RHSA-2024:0897)	Nessus	Red Hat Local Security Checks	high
190110	RHEL 8 : kernel (RHSA-2024:0724)	Nessus	Red Hat Local Security Checks	high
189666	Oracle Linux 9 : kernel (ELSA-2024-12094)	Nessus	Oracle Linux Local Security Checks	high
189572	RHEL 9 : kernel-rt (RHSA-2024:0439)	Nessus	Red Hat Local Security Checks	high
189552	RHEL 9 : kernel (RHSA-2024:0448)	Nessus	Red Hat Local Security Checks	high
180042	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3377-1)	Nessus	SuSE Local Security Checks	high
180041	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3376-1)	Nessus	SuSE Local Security Checks	high
179882	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3318-1)	Nessus	SuSE Local Security Checks	high
179829	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3313-1)	Nessus	SuSE Local Security Checks	high
179825	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3302-1)	Nessus	SuSE Local Security Checks	high
179822	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:3311-1)	Nessus	SuSE Local Security Checks	high
170472	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-025)	Nessus	Amazon Linux Local Security Checks	high
170471	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-041)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-2166

medium

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high