An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.

An update of the linux package has been released.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-4 advisory.

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could     potentially use this to expose sensitive information. (CVE-2023-3006)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-3 advisory.

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could     potentially use this to expose sensitive information. (CVE-2023-3006)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6700-2 advisory.

    It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation in the Linux kernel contained     a race condition when releasing PPPoL2TP sockets in certain conditions, leading to a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2022-20567)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-2 advisory.

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could     potentially use this to expose sensitive information. (CVE-2023-3006)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-1 advisory.

    Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions     checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of     service (bluetooth communication). (CVE-2023-2002)

    It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly     handle return values in certain error conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2023-23000)

    It was discovered that Spectre-BHB mitigations were missing for Ampere processors. A local attacker could     potentially use this to expose sensitive information. (CVE-2023-3006)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel did not properly     handle device initialization failures in certain situations, leading to a use-after-free vulnerability. A     physically proximate attacker could use this cause a denial of service (system crash). (CVE-2023-4132)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6700-1 advisory.

    It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation in the Linux kernel contained     a race condition when releasing PPPoL2TP sockets in certain conditions, leading to a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2022-20567)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle     block device modification while it is mounted. A privileged attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-34256)

    Eric Dumazet discovered that the netfilter subsystem in the Linux kernel did not properly handle DCCP     conntrack buffers in certain situations, leading to an out-of-bounds read vulnerability. An attacker could     possibly use this to expose sensitive information (kernel memory). (CVE-2023-39197)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly handle the     remount operation in certain cases, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-0775)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the     Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer     dereference vulnerability. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2024-24855)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6653-4 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6653-3 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6651-3 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the io_uring subsystem in the Linux kernel did not properly handle the release     of certain buffer rings. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2024-0582)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6648-2 advisory.

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6653-2 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6651-2 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the io_uring subsystem in the Linux kernel did not properly handle the release     of certain buffer rings. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2024-0582)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6653-1 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6651-1 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the io_uring subsystem in the Linux kernel did not properly handle the release     of certain buffer rings. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2024-0582)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6652-1 advisory.

    Marek Marczykowski-Grecki discovered that the Xen event channel infrastructure implementation in the     Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a     denial of service (paravirtualized device unavailability). (CVE-2023-34324)

    Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during     device removal. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-35827)

    Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors     in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV     guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-46813)

    It was discovered that the io_uring subsystem in the Linux kernel contained a race condition, leading to a     null pointer dereference vulnerability. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-46862)

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    It was discovered that the netfilter subsystem in the Linux kernel did not properly validate inner tunnel     netlink attributes, leading to a null pointer dereference vulnerability. A local attacker could use this     to cause a denial of service (system crash). (CVE-2023-5972)

    It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic     operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

    Jann Horn discovered that a race condition existed in the Linux kernel when handling io_uring over     sockets, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-6531)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset     expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2023-6622)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the io_uring subsystem in the Linux kernel did not properly handle the release     of certain buffer rings. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2024-0582)

    It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle     locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of     service (kernel deadlock). (CVE-2024-0641)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6648-1 advisory.

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly     check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service     (system crash). (CVE-2023-6915)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6639-1 advisory.

    It was discovered that a race condition existed in the ATM (Asynchronous Transfer Mode) subsystem of the     Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-51780)

    It was discovered that a race condition existed in the AppleTalk networking subsystem of the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-51781)

    It was discovered that a race condition existed in the Rose X.25 protocol implementation in the Linux     kernel, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-51782)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect     command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker     could use this to expose sensitive information (kernel memory). (CVE-2023-6121)

    Jann Horn discovered that a race condition existed in the Linux kernel when handling io_uring over     sockets, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-6531)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset     expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2023-6622)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Robert Morris discovered that the CIFS network file system implementation in the Linux kernel did not     properly validate certain server commands fields, leading to an out-of-bounds read vulnerability. An     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2024-0565)

    Dan Carpenter discovered that the netfilter subsystem in the Linux kernel did not store data in properly     sized memory locations. A local user could use this to cause a denial of service (system crash).
    (CVE-2024-0607)

    Jann Horn discovered that the TLS subsystem in the Linux kernel did not properly handle spliced messages,     leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2024-0646)

    Yang Chaoming discovered that the KSMBD implementation in the Linux kernel did not properly validate     request buffer sizes, leading to an out-of-bounds read vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-22705)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3710 advisory.

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON     condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a     type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing     memory corruption. (CVE-2023-1077)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In     this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on     hdev devices. (CVE-2023-1989)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a     way such that not all of the headers would come in one piece. Unfortunately the logic introduced there     didn't account for the extreme case of the entire packet being split into as many pieces as permitted by     the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible)     headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.
    (CVE-2023-34319)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

  - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before     6.4.10. There is a use-after-free because the children of an sk are mishandled. (CVE-2023-40283)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation. When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
    (CVE-2023-4206)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. When u32_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.
    (CVE-2023-4208)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane     transaction and nft_set element garbage collection, it is possible to underflow the reference counter     causing a use-after-free vulnerability. We recommend upgrading past commit     3e91b0ebd994635df2346353322ac51ce84ce6d8. (CVE-2023-4244)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system. (CVE-2023-42754)

  - A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt     pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify`     function. This issue may allow a local user to crash the system and cause a denial of service.
    (CVE-2023-42755)

  - An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-     free because of a vcc_recvmsg race condition. (CVE-2023-51780)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-     after-free because of a rose_accept race condition. (CVE-2023-51782)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an     event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory     locations outside of the allocated buffer. We recommend upgrading past commit     32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3711 advisory.

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in     drivers/net/ethernet/renesas/ravb_main.c. (CVE-2023-35827)

  - An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

  - An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access     to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES     emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege     escalation). This depends on a race condition through which userspace can replace an instruction before     the #VC handler reads it. (CVE-2023-46813)

  - An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

  - A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a     logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious user to     cause a use-after-free and double-free problem, which may permit remote code execution or lead to local     privilege escalation problem. (CVE-2023-5178)

  - An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-     free because of a vcc_recvmsg race condition. (CVE-2023-51780)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-     after-free because of a rose_accept race condition. (CVE-2023-51782)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Addition and removal of rules from chain bindings within the same     transaction causes leads to use-after-free. We recommend upgrading past commit     f15f29fd4779be8a418b66e9d52979bb6d6c2325. (CVE-2023-5197)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an     event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory     locations outside of the allocated buffer. We recommend upgrading past commit     32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set     walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-     after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204109	Photon OS 3.0: Linux PHSA-2024-3.0-0713	Nessus	PhotonOS Local Security Checks	high
193083	Ubuntu 14.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6701-4)	Nessus	Ubuntu Local Security Checks	critical
192561	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-6701-3)	Nessus	Ubuntu Local Security Checks	critical
192411	Ubuntu 16.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6700-2)	Nessus	Ubuntu Local Security Checks	high
192318	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (GCP) vulnerabilities (USN-6701-2)	Nessus	Ubuntu Local Security Checks	critical
192222	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-6701-1)	Nessus	Ubuntu Local Security Checks	critical
192220	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-6700-1)	Nessus	Ubuntu Local Security Checks	high
191494	Ubuntu 22.04 LTS : Linux kernel (GKE) vulnerabilities (USN-6653-4)	Nessus	Ubuntu Local Security Checks	high
191436	Ubuntu 22.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-6653-3)	Nessus	Ubuntu Local Security Checks	high
191433	Ubuntu 22.04 LTS : Linux kernel (StarFive) vulnerabilities (USN-6651-3)	Nessus	Ubuntu Local Security Checks	high
191100	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6648-2)	Nessus	Ubuntu Local Security Checks	high
191099	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6653-2)	Nessus	Ubuntu Local Security Checks	high
191098	Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6651-2)	Nessus	Ubuntu Local Security Checks	high
190943	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6653-1)	Nessus	Ubuntu Local Security Checks	high
190942	Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6651-1)	Nessus	Ubuntu Local Security Checks	high
190941	Ubuntu 23.10 : Linux kernel (Azure) vulnerabilities (USN-6652-1)	Nessus	Ubuntu Local Security Checks	high
190874	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6648-1)	Nessus	Ubuntu Local Security Checks	high
190559	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6639-1)	Nessus	Ubuntu Local Security Checks	high
189094	Debian dla-3710 : hyperv-daemons - security update	Nessus	Debian Local Security Checks	critical
189090	Debian dla-3711 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-51781

high

Tenable Plugins

high

critical

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical