Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable escalation of privilege via local access.

An update of the linux package has been released.

The version of kernel installed on the remote host is prior to 5.15.43-20.103. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-023 advisory.

  - An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause     a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that     SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25. (CVE-2021-28951)

  - A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

  - A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2022-0500)

  - A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
    This flaw allows a local user to cause an out-of-bounds write issue. (CVE-2022-1015)

  - A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a     use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel     information leak problem caused by a local, unprivileged attacker. (CVE-2022-1016)

  - A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the     offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw     allows unprivileged local users on the host to write outside the userspace region and potentially corrupt     the kernel, resulting in a denial of service condition. (CVE-2022-1158)

  - A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled.
    This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a     kernel oops condition that results in a denial of service. (CVE-2022-1263)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of     the availability of pointer arithmetic via certain *_OR_NULL pointer types. (CVE-2022-23222)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets     are in the intended state. (CVE-2022-28893)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring     timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race     condition perhaps can only be exploited infrequently. (CVE-2022-29582)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap. (CVE-2022-48619)

  - A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

  - A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem. (CVE-2023-1838)

  - Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics     drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-28410)

  - A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem. (CVE-2023-4387)

  - A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
    (CVE-2023-4459)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.112-108.499. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-036 advisory.

    2024-08-27: CVE-2022-48853 was added to this advisory.

    2024-06-06: CVE-2022-2977 was added to this advisory.

    2024-02-01: CVE-2022-41858 was added to this advisory.

    2024-02-01: CVE-2023-1249 was added to this advisory.

    2023-08-31: CVE-2022-28390 was removed from this advisory.

    2023-08-31: CVE-2022-1205 was removed from this advisory.

    2023-08-31: CVE-2022-1516 was removed from this advisory.

    2023-08-31: CVE-2022-28389 was removed from this advisory.

    2023-08-31: CVE-2022-1204 was removed from this advisory.

    2023-08-31: CVE-2022-28388 was removed from this advisory.

    2023-08-31: CVE-2023-1637 was added to this advisory.

    A denial of service (DOS) issue was found in the Linux kernel's smb2_ioctl_query_info function in     the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user     function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
    (CVE-2022-0168)

    When the KVM updates the guest's page table entry, it will first use get_user_pages_fast() to pin the     page, and when it fails (e.g. the vma->flags has VM_IO or VM_PFNMAP), it will get corresponding VMA where     the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the     kernel virtual address through memremap(), and finally, write the update.The problem is that when we get     the vma through find_vma_intersection(), only VM_PFNMAP is checked, not both VM_IO and VM_PFNMAP. In the     reproducer below, after the KVM_SET_USER_MEMORY_REGION is completed, we replace the guest's memory mapping     with the kernel-user shared region of io_uring and then perform the KVM_TRANSLATE operation, which finally     triggers the page table entry update. Now, memremap() will return page_offset_base (direct mapping of all     physical memory) + vaddr (the linear address of KVM_TRANSLATE) + vm_pgoff (the offset when io_uring     performs mmap(2)), and use the return value as the base address for CMPXCHG (write 0x21 in this case).
    Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously     mapped guest memory space and trigger exceptions such as UAF. The vulnerability shares similarities with     CVE-2021-22543. (CVE-2022-1158)

    A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

    A use-after-free flaw was found in the Linux kernel's io_uring interface subsystem in the way a user     triggers a race condition between timeout flush and removal. This flaw allows a local user to crash or     escalate their privileges on the system. (CVE-2022-29582)

    A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

    A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in     progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to     crash the system or leak internal kernel information. (CVE-2022-41858)

    In the Linux kernel, the following vulnerability has been resolved:

    swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-48853)

    A use-after-free flaw was found in the Linux kernel's core dump subsystem. This flaw could allow a local     user to crash the system. (CVE-2023-1249)

    A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the     Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from     suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of     the CPU similar to the speculative execution behavior kind of attacks. (CVE-2023-1637)

    Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics     drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-28410)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2782-1 advisory.

  - A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking     configuration (redirecting egress packets to ingress using TC action mirred) a local unprivileged user     could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a     retransmission, resulting in a denial of service condition. (CVE-2022-4269)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-     after-free, related to dvb_register_device dynamically allocating fops. (CVE-2022-45884)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a     race condition that can cause a use-after-free when a device is disconnected. (CVE-2022-45885)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call. (CVE-2022-45887)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON     condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a     type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing     memory corruption. (CVE-2023-1077)

  - A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when     plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to     the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED     controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led     structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.
    (CVE-2023-1079)

  - A use-after-free flaw was found in the Linux kernel's core dump subsystem. This flaw allows a local user     to crash the system. Only if patch 390031c94211 (coredump: Use the vma snapshot in fill_files_note) not     applied yet, then kernel could be affected. (CVE-2023-1249)

  - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur     when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading     to a denial of service. (CVE-2023-1380)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to     a logic error in the code. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-260821414References: Upstream kernel (CVE-2023-21102)

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

  - Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics     drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-28410)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and     font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds     occurs leading to undefined behavior and possible denial of service. (CVE-2023-3161)

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

  - An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in     drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race     condition. (CVE-2023-33288)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in     drivers/media/pci/saa7134/saa7134-core.c. (CVE-2023-35823)

  - An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in     renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. (CVE-2023-35828)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2653-1 advisory.

  - A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking     configuration (redirecting egress packets to ingress using TC action mirred) a local unprivileged user     could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a     retransmission, resulting in a denial of service condition. (CVE-2022-4269)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-     after-free, related to dvb_register_device dynamically allocating fops. (CVE-2022-45884)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a     race condition that can cause a use-after-free when a device is disconnected. (CVE-2022-45885)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call. (CVE-2022-45887)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when     plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to     the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED     controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led     structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.
    (CVE-2023-1079)

  - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur     when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading     to a denial of service. (CVE-2023-1380)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

  - Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics     drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-28410)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

  - An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in     drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race     condition. (CVE-2023-33288)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2500-1 advisory.

  - A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking     configuration (redirecting egress packets to ingress using TC action mirred) a local unprivileged user     could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a     retransmission, resulting in a denial of service condition. (CVE-2022-4269)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-     after-free, related to dvb_register_device dynamically allocating fops. (CVE-2022-45884)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a     race condition that can cause a use-after-free when a device is disconnected. (CVE-2022-45885)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a     .disconnect versus dvb_device_open race condition that leads to a use-after-free. (CVE-2022-45886)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call. (CVE-2022-45887)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when     plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to     the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED     controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led     structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.
    (CVE-2023-1079)

  - A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur     when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading     to a denial of service. (CVE-2023-1380)

  - A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This     issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc     protocol in the Linux kernel. (CVE-2023-1382)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - An out-of-bounds memory access flaw was found in the Linux kernel's XFS file system in how a user restores     an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or     potentially escalate their privileges on the system. (CVE-2023-2124)

  - A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol.
    This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion     failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the     system. (CVE-2023-2156)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

  - A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the     extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system     crash or other undefined behaviors. (CVE-2023-2513)

  - Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics     drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable     escalation of privilege via local access. (CVE-2023-28410)

  - A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes     actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code     uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted     branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted     branches can cause cache allocation. This issue leads to obtaining information that should not be     accessible. (CVE-2023-3006)

  - An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64     lacks consistency checks for CR0 and CR4. (CVE-2023-30456)

  - An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a     blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is     called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event,     down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and     down(&fepriv->sem) may block the process. (CVE-2023-31084)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

  - An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in     drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race     condition. (CVE-2023-33288)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204515	Photon OS 4.0: Linux PHSA-2023-4.0-0420	Nessus	PhotonOS Local Security Checks	high
180569	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2023-023)	Nessus	Amazon Linux Local Security Checks	high
180564	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-036)	Nessus	Amazon Linux Local Security Checks	high
178457	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2871-1)	Nessus	SuSE Local Security Checks	high
178179	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2809-1)	Nessus	SuSE Local Security Checks	high
177994	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2782-1)	Nessus	SuSE Local Security Checks	high
177698	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2653-1)	Nessus	SuSE Local Security Checks	high
177282	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:2500-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-28410

high

Tenable Plugins

high

high

high

high

high

high

high

high