In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated. I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF: ================================================================== BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3841 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3841-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     June 25, 2024                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.209-2~deb10u1     CVE ID         : CVE-2023-6040 CVE-2023-6356 CVE-2023-6535 CVE-2023-6536                      CVE-2023-6606 CVE-2023-6915 CVE-2023-39198 CVE-2023-46838                      CVE-2023-51779 CVE-2023-52340 CVE-2023-52436 CVE-2023-52438                      CVE-2023-52439 CVE-2023-52443 CVE-2023-52444 CVE-2023-52445                      CVE-2023-52448 CVE-2023-52449 CVE-2023-52451 CVE-2023-52454                      CVE-2023-52456 CVE-2023-52457 CVE-2023-52462 CVE-2023-52463                      CVE-2023-52464 CVE-2023-52467 CVE-2023-52469 CVE-2023-52470                      CVE-2023-52609 CVE-2023-52612 CVE-2023-52675 CVE-2023-52679                      CVE-2023-52683 CVE-2023-52686 CVE-2023-52690 CVE-2023-52691                      CVE-2023-52693 CVE-2023-52694 CVE-2023-52696 CVE-2023-52698                      CVE-2024-0646 CVE-2024-1086 CVE-2024-24860 CVE-2024-26586                      CVE-2024-26597 CVE-2024-26598 CVE-2024-26633

    Several vulnerabilities were discovered in the Linux kernel that may     lead to a privilege escalation, denial of service or information     leaks.

    For Debian 10 buster, these problems were fixed earlier in version     5.10.209-2~deb10u1.  This update additionally included many more bug     fixes from stable updates 5.10.206-5.10.209 inclusive.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel-generic installed on the remote host is prior to 5.15.160 / 5.15.160_smp. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-157-01 advisory.

    New kernel packages are available for Slackware 15.0 to fix security issues.

Tenable has extracted the preceding description block directly from the kernel-generic security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of     transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is     partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or     IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under     some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in
    __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800
    __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is     used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger     than the amount of data in the message iterator. This is because the requested length includes the     transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6,     SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100,     MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the     write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks     like it won't suffer from this problem as it builds the UDP packet itself.(CVE-2023-52527)

    In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in     shinker's callback The mmap read lock is used during the shrinker's callback, which means that using     alloc-vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ('mm: mmap: zap     pages with read mmap_sem in munmap') the mmap lock is downgraded after the vma has been isolated. I was     able to reproduce this issue by manually adding some delays and triggering page reclaiming through the     shrinker's debug sysfs.(CVE-2023-52438)

    A flaw in the routing table size was found in the ICMPv6 handling of  Packet Too Big . The size of the     routing table is regulated by periodic garbage collection. However, with  Packet Too Big Messages  it is     possible to exceed the routing table size and garbage collector threshold. A user located in the local     network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6     connections up to 95%.(CVE-2023-52340)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT.(CVE-2024-1086)

    A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel     hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or     potentially escalate their privileges on the system.(CVE-2024-0841)

    In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload.(CVE-2023-51043)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality.(CVE-2024-0607)

    A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernels SCTP subsystem. This flaw allows guests with local user     privileges to trigger a deadlock and potentially crash the system.(CVE-2024-0639)

    A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return.(CVE-2023-6915)

    Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0.(CVE-2021-33631)

    A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernels TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system.(CVE-2024-0641)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued     on.(CVE-2023-6531)

    An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access.(CVE-2023-6040)

    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.(CVE-2024-0565)

    An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap.(CVE-2022-48619)

    A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file.(CVE-2024-0340)

    A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow.(CVE-2023-7192)

    A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system.(CVE-2024-0193)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer     (dmesg).(CVE-2023-6121)

    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel     information.(CVE-2023-6606)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group().(CVE-2023-6931)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6724-2 advisory.

  - Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really     useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides     a certain initial portion of the to be transferred data, these parts are directly translated into what     Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of     length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

  - sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5     allows an information leak to user space because info->pad0 is not initialized. (CVE-2023-50431)

  - dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in     alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct     dm_ioctl.target_count. (CVE-2023-52429)

  - In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in     smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in     smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG:
    unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF:
    error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU:
    3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),     BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0     [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41     29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP:
    0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90     RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08:
    ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000     R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000)     GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ?
    __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ?     srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ?     smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260     [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs]     cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs]     vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ?
    _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0     entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e (CVE-2023-52434)

  - In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in     skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a     forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily :
    mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final     result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1]     general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP     KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-     executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute     Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30     net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48     b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84     24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX:
    ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578     R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12:
    ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS:
    0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109     ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53
    __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline]     validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338     dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276     packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119     sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745
    __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto     net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64     arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3     e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246     ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX:
    0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540     R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13:
    0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 </TASK> Modules linked in: ---[ end trace     0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed     ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea     03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS:
    00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI:
    ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R0 ---truncated--- (CVE-2023-52435)

  - In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the     xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile     assumption that the unused xattr space is always zeroed. (CVE-2023-52436)

  - In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in     shinker's callback The mmap read lock is used during the shrinker's callback, which means that using     alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e (mm: mmap: zap     pages with read mmap_sem in munmap) the mmap lock is downgraded after the vma has been isolated. I was     able to reproduce this issue by manually adding some delays and triggering page reclaiming through the     shrinker's debug sysfs. The following KASAN report confirms the UAF:
    ================================================================== BUG: KASAN: slab-use-after-free in     zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478     Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call     trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc
    __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc     shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758     ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368     vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c     ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8     vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last     potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c     vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c     do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing     instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade.
    Note that this option has better performance than upgrading to a mmap write lock which would increase     contention. Plus, mmap_write_trylock() has been recently removed anyway. (CVE-2023-52438)

  - In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open     core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev     = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release     get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev)
    ------------------------------------------------------- In the core-1 uio_unregister_device(), the     device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister,     put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2     will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double     freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.
    (CVE-2023-52439)

  - An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6610)

  - An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in     fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship     between Name data and CreateContexts data is mishandled. (CVE-2024-22705)

  - In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion     failure and crash because a subvolume can be read out too soon after its root item is inserted upon     subvolume creation. (CVE-2024-23850)

  - copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than     INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to     ctl_ioctl. (CVE-2024-23851)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6725-2 advisory.

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     certain data structure fields when parsing lease contexts, leading to an out-of-bounds read vulnerability.
    A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-1194)

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel,     leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-32254)

    It was discovered that a race condition existed in the KSMBD implementation in the Linux kernel when     handling session connections, leading to a use- after-free vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32258)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes     in certain operations, leading to an integer underflow and out-of-bounds read vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-38427)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate SMB     request protocol IDs, leading to a out-of- bounds read vulnerability. A remote attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-38430)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     packet header sizes in certain situations, leading to an out-of-bounds read vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-38431)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly handle session setup     requests, leading to an out-of-bounds read vulnerability. A remote attacker could use this to expose     sensitive information. (CVE-2023-3867)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that the IPv6 implementation of the Linux kernel did not properly manage route cache     memory usage. A remote attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2023-52340)

    It was discovered that the device mapper driver in the Linux kernel did not properly validate target size     during certain memory allocations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-52429, CVE-2024-23851)

    Yang Chaoming discovered that the KSMBD implementation in the Linux kernel did not properly validate     request buffer sizes, leading to an out-of-bounds read vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-22705)

    Chenyuan Yang discovered that the btrfs file system in the Linux kernel did not properly handle read     operations on newly created subvolumes in certain conditions. A local attacker could use this to cause a     denial of service (system crash). (CVE-2024-23850)

    It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to     a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a     denial of service (system crash). (CVE-2024-24860)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Architecture specifics;

    - Block layer;

    - Cryptographic API;

    - Android drivers;

    - EDAC drivers;

    - GPU drivers;

    - Media drivers;

    - Multifunction device drivers;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - EFI Variable file system;

    - F2FS file system;

    - GFS2 file system;

    - SMB network file system;

    - BPF subsystem;

    - IPv6 Networking;

    - Network Traffic Control;

    - AppArmor security module; (CVE-2023-52463, CVE-2023-52445, CVE-2023-52462, CVE-2023-52609,     CVE-2023-52448, CVE-2023-52457, CVE-2023-52464, CVE-2023-52456, CVE-2023-52454, CVE-2023-52438,     CVE-2023-52480, CVE-2023-52443, CVE-2023-52442, CVE-2024-26631, CVE-2023-52439, CVE-2023-52612,     CVE-2024-26598, CVE-2024-26586, CVE-2024-26589, CVE-2023-52444, CVE-2023-52436, CVE-2024-26633,     CVE-2024-26597, CVE-2023-52458, CVE-2024-26591, CVE-2023-52449, CVE-2023-52467, CVE-2023-52441,     CVE-2023-52610, CVE-2023-52451, CVE-2023-52469, CVE-2023-52470)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6724-1 advisory.

  - Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really     useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides     a certain initial portion of the to be transferred data, these parts are directly translated into what     Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of     length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

  - sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5     allows an information leak to user space because info->pad0 is not initialized. (CVE-2023-50431)

  - dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in     alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct     dm_ioctl.target_count. (CVE-2023-52429)

  - In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in     smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in     smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG:
    unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF:
    error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU:
    3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),     BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0     [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41     29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP:
    0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90     RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08:
    ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000     R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000)     GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2:
    ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ?
    __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ?     srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ?     smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260     [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs]     cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs]     vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ?
    _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0     entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e (CVE-2023-52434)

  - In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in     skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a     forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily :
    mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final     result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1]     general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP     KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-     executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute     Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30     net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48     b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84     24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX:
    ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578     R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12:
    ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS:
    0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
    0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109     ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53
    __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline]     validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626 __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338     dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276     packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119     sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745
    __sys_sendto+0x255/0x340 net/socket.c:2190 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto     net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198 do_syscall_x64     arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83     entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f8692032aa9 Code: 28 00 00 00 75 05 48 83 c4 28 c3     e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0     ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff8d685418 EFLAGS: 00000246     ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9 RDX:
    0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000000f4240 R08: 0000000020000540     R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480 R13:
    0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003 </TASK> Modules linked in: ---[ end trace     0000000000000000 ]--- RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed     ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea     03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS:
    00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI:
    ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R0 ---truncated--- (CVE-2023-52435)

  - In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the     xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile     assumption that the unused xattr space is always zeroed. (CVE-2023-52436)

  - In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in     shinker's callback The mmap read lock is used during the shrinker's callback, which means that using     alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e (mm: mmap: zap     pages with read mmap_sem in munmap) the mmap lock is downgraded after the vma has been isolated. I was     able to reproduce this issue by manually adding some delays and triggering page reclaiming through the     shrinker's debug sysfs. The following KASAN report confirms the UAF:
    ================================================================== BUG: KASAN: slab-use-after-free in     zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478     Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call     trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc
    __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc     shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758     ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368     vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c     ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8     vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last     potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c     vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c     do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c Fix this issue by performing     instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade.
    Note that this option has better performance than upgrading to a mmap write lock which would increase     contention. Plus, mmap_write_trylock() has been recently removed anyway. (CVE-2023-52438)

  - In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open     core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev     = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release     get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev)
    ------------------------------------------------------- In the core-1 uio_unregister_device(), the     device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister,     put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2     will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double     freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.
    (CVE-2023-52439)

  - An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6610)

  - An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in     fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship     between Name data and CreateContexts data is mishandled. (CVE-2024-22705)

  - In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion     failure and crash because a subvolume can be read out too soon after its root item is inserted upon     subvolume creation. (CVE-2024-23850)

  - copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than     INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to     ctl_ioctl. (CVE-2024-23851)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6725-1 advisory.

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     certain data structure fields when parsing lease contexts, leading to an out-of-bounds read vulnerability.
    A remote attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-1194)

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel,     leading to a use-after-free vulnerability. A remote attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-32254)

    It was discovered that a race condition existed in the KSMBD implementation in the Linux kernel when     handling session connections, leading to a use- after-free vulnerability. A remote attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-32258)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly validate buffer sizes     in certain operations, leading to an integer underflow and out-of-bounds read vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-38427)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate SMB     request protocol IDs, leading to a out-of- bounds read vulnerability. A remote attacker could possibly use     this to cause a denial of service (system crash). (CVE-2023-38430)

    Chih-Yen Chang discovered that the KSMBD implementation in the Linux kernel did not properly validate     packet header sizes in certain situations, leading to an out-of-bounds read vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information. (CVE-2023-38431)

    It was discovered that the KSMBD implementation in the Linux kernel did not properly handle session setup     requests, leading to an out-of-bounds read vulnerability. A remote attacker could use this to expose     sensitive information. (CVE-2023-3867)

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that the IPv6 implementation of the Linux kernel did not properly manage route cache     memory usage. A remote attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2023-52340)

    It was discovered that the device mapper driver in the Linux kernel did not properly validate target size     during certain memory allocations. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-52429, CVE-2024-23851)

    Yang Chaoming discovered that the KSMBD implementation in the Linux kernel did not properly validate     request buffer sizes, leading to an out-of-bounds read vulnerability. An attacker could use this to cause     a denial of service (system crash) or possibly expose sensitive information. (CVE-2024-22705)

    Chenyuan Yang discovered that the btrfs file system in the Linux kernel did not properly handle read     operations on newly created subvolumes in certain conditions. A local attacker could use this to cause a     denial of service (system crash). (CVE-2024-23850)

    It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to     a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a     denial of service (system crash). (CVE-2024-24860)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Architecture specifics;

    - Block layer;

    - Cryptographic API;

    - Android drivers;

    - EDAC drivers;

    - GPU drivers;

    - Media drivers;

    - Multifunction device drivers;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - EFI Variable file system;

    - F2FS file system;

    - GFS2 file system;

    - SMB network file system;

    - BPF subsystem;

    - IPv6 Networking;

    - Network Traffic Control;

    - AppArmor security module; (CVE-2023-52463, CVE-2023-52445, CVE-2023-52462, CVE-2023-52609,     CVE-2023-52448, CVE-2023-52457, CVE-2023-52464, CVE-2023-52456, CVE-2023-52454, CVE-2023-52438,     CVE-2023-52480, CVE-2023-52443, CVE-2023-52442, CVE-2024-26631, CVE-2023-52439, CVE-2023-52612,     CVE-2024-26598, CVE-2024-26586, CVE-2024-26589, CVE-2023-52444, CVE-2023-52436, CVE-2024-26633,     CVE-2024-26597, CVE-2023-52458, CVE-2024-26591, CVE-2023-52449, CVE-2023-52467, CVE-2023-52441,     CVE-2023-52610, CVE-2023-52451, CVE-2023-52469, CVE-2023-52470)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6688-1 advisory.

    Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly     handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a     guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

    It was discovered that the Habana's AI Processors driver in the Linux kernel did not properly initialize     certain data structures before passing them to user space. A local attacker could use this to expose     sensitive information (kernel memory). (CVE-2023-50431)

    Murray McAllister discovered that the VMware Virtual GPU DRM driver in the Linux kernel did not properly     handle memory objects when storing surfaces, leading to a use-after-free vulnerability. A local attacker     in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-5633)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this     to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6610)

    It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some     situations. A local attacker could use this to possibly expose sensitive information (kernel memory).
    (CVE-2024-0340)

    Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element     deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1085)

    Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict     parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

    Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-     bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system     crash). (CVE-2024-23849)

    It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to     a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a     denial of service (system crash). (CVE-2024-24860)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - Architecture specifics;

    - Block layer;

    - ACPI drivers;

    - Android drivers;

    - EDAC drivers;

    - GPU drivers;

    - InfiniBand drivers;

    - Media drivers;

    - Multifunction device drivers;

    - MTD block device drivers;

    - Network drivers;

    - NVME drivers;

    - PHY drivers;

    - PWM drivers;

    - SCSI drivers;

    - SPMI drivers;

    - TTY drivers;

    - Userspace I/O drivers;

    - Ceph distributed file system;

    - EFI Variable file system;

    - Ext4 file system;

    - F2FS file system;

    - GFS2 file system;

    - JFS file system;

    - SMB network file system;

    - BPF subsystem;

    - Logical Link Layer;

    - Netfilter;

    - Unix domain sockets;

    - AppArmor security module; (CVE-2024-26599, CVE-2023-52604, CVE-2023-52439, CVE-2024-26627,     CVE-2024-26601, CVE-2024-26628, CVE-2023-52607, CVE-2023-52456, CVE-2023-52602, CVE-2023-52443,     CVE-2023-52599, CVE-2023-52603, CVE-2024-26588, CVE-2024-26581, CVE-2023-52600, CVE-2024-26624,     CVE-2023-52584, CVE-2024-26625, CVE-2023-52606, CVE-2023-52463, CVE-2023-52464, CVE-2023-52597,     CVE-2023-52595, CVE-2023-52458, CVE-2023-52457, CVE-2023-52438, CVE-2023-52469, CVE-2023-52462,     CVE-2024-26589, CVE-2024-26592, CVE-2024-26594, CVE-2023-52601, CVE-2023-52593, CVE-2023-52436,     CVE-2023-52447, CVE-2023-52587, CVE-2023-52445, CVE-2023-52454, CVE-2023-52451, CVE-2023-52605,     CVE-2024-26597, CVE-2023-52448, CVE-2023-52598, CVE-2024-26591, CVE-2023-52449, CVE-2023-52444,     CVE-2023-52583, CVE-2023-52589, CVE-2024-26598, CVE-2023-52470, CVE-2023-52594, CVE-2023-52588,     CVE-2023-52467, CVE-2024-26600)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201106	Debian dla-3841 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	high
200129	Slackware Linux 15.0 kernel-generic Multiple Vulnerabilities (SSA:2024-157-01)	Nessus	Slackware Local Security Checks	high
198320	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2024-1800)	Nessus	Huawei Local Security Checks	high
198313	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2024-1788)	Nessus	Huawei Local Security Checks	high
198192	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1764)	Nessus	Huawei Local Security Checks	high
198188	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1741)	Nessus	Huawei Local Security Checks	high
198105	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2024-1735)	Nessus	Huawei Local Security Checks	high
198091	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2024-1734)	Nessus	Huawei Local Security Checks	high
193407	Ubuntu 20.04 LTS : Linux kernel (Xilinx ZynqMP) vulnerabilities (USN-6726-3)	Nessus	Ubuntu Local Security Checks	high
193377	Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6724-2)	Nessus	Ubuntu Local Security Checks	high
193376	Ubuntu 20.04 LTS : Linux kernel (IoT) vulnerabilities (USN-6726-2)	Nessus	Ubuntu Local Security Checks	high
193375	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6725-2)	Nessus	Ubuntu Local Security Checks	critical
193085	Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6724-1)	Nessus	Ubuntu Local Security Checks	high
193084	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6725-1)	Nessus	Ubuntu Local Security Checks	critical
193081	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6726-1)	Nessus	Ubuntu Local Security Checks	high
191796	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6688-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2023-52438

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

critical

high

critical

high

high