In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function 'usb_get_bos_descriptor()' encounters an iteration issue when skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in the same descriptor being read repeatedly. To address this issue, a 'goto' statement is introduced to ensure that the pointer and the amount read is updated correctly. This ensures that the function iterates to the next descriptor instead of reading the same descriptor repeatedly.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function.
    This can result in a bluetooth sniffing exception issue, possibly leading denial of     service.(CVE-2024-24859)

    bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq(CVE-2024-38540)

    drivers: core: synchronize really_probe() and dev_uevent()(CVE-2024-39501)

    drm/amd/display: Fix potential index out of bounds in color transformation function(CVE-2024-38552)

    drop_monitor: replace spin_lock by raw_spin_lock(CVE-2024-40980)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)

    ext4: do not create EA inode under buffer lock(CVE-2024-40972)

    HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()(CVE-2024-40934)

    ice: Fix crash by keep old cfg when update TCs more than queues(CVE-2022-48652)

    In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to     drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.(CVE-2024-23848)

    ipv6: fix possible race in __fib6_drop_pcpu_from()(CVE-2024-40905)

    ipv6: fix potential 'struct net' leak in inet6_rtm_getaddr()(CVE-2024-27417)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    kernel:dm: call the resume method on internal suspend(CVE-2024-26880)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:nouveau: lock the client object tree. (CVE-2024-27062)

    kernel:nvme-fc: do not wait in vain when unloading module(CVE-2024-26846)

    kernel:of: Fix double free in of_parse_phandle_with_args_map(CVE-2023-52679)

    kernel:of: module: add buffer overflow check in of_modalias()(CVE-2024-38541)

    kernel:scsi: lpfc: Fix link down processing to address NULL pointer dereference(CVE-2021-47183)

    kernel:SUNRPC: fix some memleaks in gssx_dec_option_array(CVE-2024-27388)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING(CVE-2024-39476)

    md: fix resync softlockup when bitmap size is less than array size(CVE-2024-38598)

    media: imon: fix access to invalid resource for the second interface(CVE-2023-52754)

    net/mlx5: Add a timeout to acquire the command queue semaphore(CVE-2024-38556)

    net/mlx5: Discard command completions in internal error(CVE-2024-38555)

    net/mlx5e: Fix netif state handling(CVE-2024-38608)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    netfilter: bridge: replace physindev with physinif in nf_bridge_info(CVE-2024-35839)

    netfilter: ipset: fix performance regression in swap operation(CVE-2024-26910)

    netfilter: nf_tables: flush pending destroy work before exit_net release(CVE-2024-35899)

    netfilter: nf_tables: honor table dormant flag from netdev release event path(CVE-2024-36005)

    netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()(CVE-2024-36286)

    NFSD: Fix ia_size underflow(CVE-2022-48828)

    RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt(CVE-2024-38544)

    scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory(CVE-2024-40901)

    tipc: force a dst refcount before doing decryption(CVE-2024-40983)

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()'(CVE-2023-52781)

    bcache: fix variable length array abuse in btree_iter(CVE-2024-39482)

    pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER(CVE-2024-42090)

    udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().(CVE-2024-41041)

    net: hns3: fix kernel crash when 1588 is received on HIP08 devices(CVE-2024-26881)

    bpf: Fix a segment issue when downgrading gso_size(CVE-2024-42281)

    quota: Fix potential NULL pointer dereference(CVE-2024-26878)

    rds: tcp: Fix use-after-free of net in reqsk_timer_handler().(CVE-2024-26865)

    io_uring: fix possible deadlock in io_register_iowq_max_workers()(CVE-2024-41080)

    ASoC: topology: Fix references to freed memory(CVE-2024-41069)

    crypto: hisilicon/sec - Fix memory leak for sec resource release(CVE-2024-41002)

    filelock: Remove locks reliably when fcntl/close race is detected(CVE-2024-41012)

    x86: stop playing stack games in profile_pc()(CVE-2024-42096)

    iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected(CVE-2024-26891)

    xfs: add bounds checking to xlog_recover_process_data(CVE-2024-41014)

    xfs: don't walk off the end of a directory data block(CVE-2024-41013)

    sched/deadline: Fix task_struct reference leak(CVE-2024-41023)

    of: module: prevent NULL pointer dereference in vsnprintf()(CVE-2024-35878)

    mm: avoid overflows in dirty throttling logic(CVE-2024-42131)

    drm/ nouveau: fix null pointer dereference in nouveau_connector_get_modes(CVE-2024-42101)

    crypto: ecdh - explicitly zeroize private_key(CVE-2024-42098)

    Fix userfaultfd_api to return EINVAL as expected(CVE-2024-41027)

    ftruncate: pass a signed offset(CVE-2024-42084)

    nvmet: fix a possible leak when destroy a ctrl during qp establishment(CVE-2024-42152)

    nvmet: always initialize cqe.result(CVE-2024-41079)

    crypto: aead,cipher - zeroize key buffer after use(CVE-2024-42229)

    Bluetooth: L2CAP: Fix not validating setsockopt user input(CVE-2024-35965)

    KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()(CVE-2024-40953)

    filelock: Fix fcntl/close race recovery compat path(CVE-2024-41020)

    USB: serial: mos7840: fix crash on resume(CVE-2024-42244)

    tty: add the option to have a tty reject a new ldisc(CVE-2024-40966)

    media: dvb-frontends: tda10048: Fix integer overflow(CVE-2024-42223)

    ata: libata-core: Fix double free on error(CVE-2024-41087)

    ata: libata-core: Fix null pointer dereference on error(CVE-2024-41098)

    leds: trigger: Unregister sysfs attributes before calling deactivate()(CVE-2024-43830)

    enic: Validate length of nl attributes in enic_set_vf_port(CVE-2024-38659)

    tap: add missing verification for short frame(CVE-2024-41090)

    tun: add missing verification for short frame(CVE-2024-41091)

    netfilter: tproxy: bail out if IP has been disabled on the device(CVE-2024-36270)

    ext4: make sure the first directory block is not a hole(CVE-2024-42304)

    ext4: fix infinite loop when replaying fast_commit(CVE-2024-43828)

    ppp: reject claimed-as-LCP but actually malformed packets(CVE-2024-41044)

    RDMA/restrack: Fix potential invalid address access(CVE-2024-42080)

    nvme-fabrics: use reserved tag for reg read/write command(CVE-2024-41082)

    bnx2x: Fix multiple UBSAN array-index-out-of-bounds(CVE-2024-42148)

    inet_diag: Initialize pad field in struct inet_diag_req_v2(CVE-2024-42106)

    bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD(CVE-2024-42161)

    drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)(CVE-2024-39497)

    drm/amd/display: Add NULL pointer check for kzalloc(CVE-2024-42122)

    net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket(CVE-2024-42246)

    net: phy: fix phy_get_internal_delay accessing an empty array(CVE-2024-27047)

    tcp_metrics: validate source addr length(CVE-2024-42154)

    netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers(CVE-2024-42070)

    RDMA/hns: Modify the print level of CQE error(CVE-2024-38590)

    udp: do not accept non-tunnel GSO skbs landing in a tunnel(CVE-2024-35884)

    skmsg: Skip zero length skb in sk_msg_recvmsg(CVE-2024-41048)

    xdp: Remove WARN() from __xdp_reg_mem_model()(CVE-2024-42082)

    HID: core: remove unnecessary WARN_ON() in implement()(CVE-2024-39509)

    net: nexthop: Initialize all fields in dumped nexthops(CVE-2024-42283)

    IB/core: Implement a limit on UMAD receive List(CVE-2024-42145)

    RDMA/iwcm: Fix a use-after-free related to destroying CM IDs(CVE-2024-42285)

    ipvs: properly dereference pe in ip_vs_add_service(CVE-2024-42322)

    net: usb: qmi_wwan: fix memory leak for not ip packets(CVE-2024-43861)

    libceph: fix race between delayed_work() and ceph_monc_stop()(CVE-2024-42232)

    tipc: Return non-zero value from tipc_udp_addr2str() on error(CVE-2024-42284)

    drm/ nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes(CVE-2024-41089)

    netfilter: nf_tables: prefer nft_chain_validate(CVE-2024-41042)

    net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE(CVE-2024-42321)

    net/mlx5: Always drain health in shutdown callback(CVE-2024-43866)

    USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor(CVE-2024-41035)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2896-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
    - CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
    - CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
    - CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
    - CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
    - CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
    - CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()     (bsc#1227866).
    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
    - CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
    - CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
    - CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
    - CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
    - CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
    - CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
    - CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
    - CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
    - CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
    - CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
    - CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
    - CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
    - CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
    - CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
    - CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
    - CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
    - CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()     (bsc#1227779).
    - CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
    - CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
    - CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
    - CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
    - CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
    - CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
    - CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
    - CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
    - CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
    - CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
    - CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
    - CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
    - CVE-2024-35890: gro: fix ownership transfer (bsc#1224516).
    - CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (bsc#1225719).
    - CVE-2024-36946: phonet: fix rtm_phonet_notify() skb allocation (bsc#1225851).
    - CVE-2024-38586: r8169: Fix possible ring buffer corruption on fragmented Tx packets (bsc#1226750).
    - CVE-2024-39468: smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103.
    - CVE-2024-40906: net/mlx5: Always stop health timer during driver removal (bsc#1227763).
    - CVE-2024-27012: netfilter: nf_tables: restore set elements when delete set fails (bsc#1223804).
    - CVE-2024-39498: drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 (bsc#1227723)
    - CVE-2024-39502: ionic: fix use after netif_napi_del() (bsc#1227755).
    - CVE-2024-27016: netfilter: flowtable: validate pppoe header (bsc#1223807).
    - CVE-2024-36901: ipv6: prevent NULL dereference in ip6_output() (bsc#1225711)
    - CVE-2024-36004: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1224545)
    - CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
    - CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (bsc#1224604).
    - CVE-2024-35854: Fixed possible use-after-free during rehash (bsc#1224636).
    - CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
    - CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
    - CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
    - CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
    - CVE-2024-27064: netfilter: nf_tables: Fix a memory leak in nf_tables_updchain (bsc#1223740).
    - CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
    - CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601, bsc#1225600).
    - CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
    - CVE-2024-38558: net: openvswitch: fix overwriting ct original tuple for ICMPv6 (bsc#1226783).
    - CVE-2024-39490: ipv6: sr: fix missing sk_buff release in seg6_input_core (bsc#1227626).
    - CVE-2024-26826: mptcp: fix data re-injection from stale subflow (bsc#1223010).
    - CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
    - CVE-2024-35942: pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain (bsc#1224589).
    - CVE-2024-26691: KVM: arm64: Fix circular locking dependency (bsc#1222463).
    - CVE-2024-36909: Drivers: hv: vmbus: Do not free ring buffers that couldn't be re-encrypted     (bsc#1225744).
    - CVE-2024-36910: uio_hv_generic: Do not free decrypted memory (bsc#1225717).
    - CVE-2024-36911: hv_netvsc: Do not free decrypted memory (bsc#1225745).
    - CVE-2024-36912: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752).
    - CVE-2024-36913: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753).
    - CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
    - CVE-2024-38659: enic: Validate length of nl attributes in enic_set_vf_port (bsc#1226883).
    - CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
    - CVE-2024-39482: bcache: fix variable length array abuse in btree_iter (bsc#1227447).
    - CVE-2024-39474: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL (bsc#1227434).
    - CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
    - CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
    - CVE-2024-38598: md: fix resync softlockup when bitmap size is less than array size (bsc#1226757).
    - CVE-2024-36003: ice: fix LAG and VF lock dependency in ice_reset_vf() (bsc#1224544).
    - CVE-2024-38604: block: refine the EOF check in blkdev_iomap_begin (bsc#1226866).
    - CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
    - CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
    - CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
    - CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
    - CVE-2024-26785: iommufd: Fix protection fault in iommufd_test_syz_conv_iova (bsc#1222779).
    - CVE-2024-26734: devlink: fix possible use-after-free and memory leaks in devlink_init() (bsc#1222438).
    - CVE-2024-35805: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743).
    - CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
    - CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
    - CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
    - CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
    - CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
    - CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
    - CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
    - CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
    - CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
    - CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
    - CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
    - CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
    - CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
    - CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
    - CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
    - CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules     (bsc#1226799).
    - CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
    - CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'     (bsc#1226841).
    - CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
    - CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
    - CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE     (bsc#1226789).
    - CVE-2024-38566: bpf: Fix verifier assumptions about socket->sk (bsc#1226790).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
    - CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
    - CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
    - CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
    - CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
    - CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
    - CVE-2024-38556: net/mlx5: Add a timeout to acquire the command queue semaphore (bsc#1226774).
    - CVE-2024-38557: net/mlx5: Reload only IB representors upon lag disable/enable (bsc#1226781).
    - CVE-2024-38608: net/mlx5e: Fix netif state handling (bsc#1226746).
    - CVE-2024-38597: eth: sungem: remove .ndo_poll_controller to avoid deadlocks (bsc#1226749).
    - CVE-2024-38594: net: stmmac: move the EST lock to struct stmmac_priv (bsc#1226734).
    - CVE-2024-38569: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group (bsc#1226772).
    - CVE-2024-38568: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group (bsc#1226771).
    - CVE-2024-26814: vfio/fsl-mc: Block calling interrupt handler without trigger (bsc#1222810).
    - CVE-2024-26813: vfio/platform: Create persistent IRQ handlers (bsc#1222809).
    - CVE-2024-36945: net/smc: fix neighbour and rtable leak in smc_ib_find_route() (bsc#1225823).
    - CVE-2024-36923: fs/9p: fix uninitialized values during inode evict (bsc#1225815).
    - CVE-2024-36971: net: fix __dst_negative_advice() race (bsc#1226145).
    - CVE-2024-27414: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back (bsc#1224439).
    - CVE-2024-35900: netfilter: nf_tables: reject new basechain after table flag update (bsc#1224497).
    - CVE-2024-35886: ipv6: Fix infinite recursion in fib6_dump_done() (bsc#1224670).
    - CVE-2024-36024: drm/amd/display: Disable idle reallow as part of command/gpint execution (bsc#1225702).
    - CVE-2024-36903: ipv6: Fix potential uninit-value access in __ip6_make_skb() (bsc#1225741).
    - CVE-2024-36914: drm/amd/display: Skip on writeback when it's not applicable (bsc#1225757).
    - CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225737).
    - CVE-2024-35979: raid1: fix use-after-free for original bio in raid1_write_request() (bsc#1224572).
    - CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
    - CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
    - CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
    - CVE-2024-35898: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()     (bsc#1224498).
    - CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
    - CVE-2024-36017: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (bsc#1225681).
    - CVE-2024-36882: mm: use memalloc_nofs_save() in page_cache_ra_order() (bsc#1225723).
    - CVE-2024-36916: blk-iocost: avoid out of bounds shift (bsc#1225759).
    - CVE-2024-36900: net: hns3: fix kernel crash when devlink reload during initialization (bsc#1225726).
    - CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
    - CVE-2024-35925: block: prevent division by zero in blk_rq_stat_sum() (bsc#1224661).
    - CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
    - CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
    - CVE-2024-36934: bna: ensure the copied buf is NUL terminated (bsc#1225760).
    - CVE-2024-36935: ice: ensure the copied buf is NUL terminated (bsc#1225763).
    - CVE-2024-36937: xdp: use flags field to disambiguate broadcast redirect (bsc#1225834).
    - CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
    - CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
    - CVE-2024-36005: netfilter: nf_tables: honor table dormant flag from netdev release event path     (bsc#1224539).
    - CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
    - CVE-2024-35892: net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() (bsc#1224515).
    - CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
    - CVE-2024-35884: udp: do not accept non-tunnel GSO skbs landing in a tunnel (bsc#1224520).
    - CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
    - CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
    - CVE-2024-35926: crypto: iaa - Fix async_disable descriptor leak (bsc#1224655).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
    - CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
    - CVE-2024-36008: ipv4: check for NULL idev in ip_route_use_hint() (bsc#1224540).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
    - CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
    - CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2024-35880: io_uring/kbuf: hold io_buffer_list reference over mmap (bsc#1224523).
    - CVE-2024-35831: io_uring: Fix release of pinned pages when __io_uaddr_map fails (bsc#1224698).
    - CVE-2024-35827: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() (bsc#1224606).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2571-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
    - CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
    - CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
    - CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
    - CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
    - CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
    - CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
    - CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
    - CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
    - CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
    - CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
    - CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634,).
    - CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
    - CVE-2023-52759: Ignore negated quota changes (bsc#1225560).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs     (bsc#1225097).
    - CVE-2023-52864: Fixed opening of char device (bsc#1225132).
    - CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
    - CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
    - CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
    - CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
    - CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
    - CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
    - CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
    - CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
    - CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
    - CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
    - CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules     (bsc#1226799).
    - CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
    - CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'     (bsc#1226841).
    - CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
    - CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
    - CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE     (bsc#1226789).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
    - CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
    - CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
    - CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
    - CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
    - CVE-2024-38556: net/mlx5: Add a timeout to acquire the command queue semaphore (bsc#1226774).
    - CVE-2024-38557: net/mlx5: Reload only IB representors upon lag disable/enable (bsc#1226781).
    - CVE-2024-38608: net/mlx5e: Fix netif state handling (bsc#1226746).
    - CVE-2024-38597: eth: sungem: remove .ndo_poll_controller to avoid deadlocks (bsc#1226749).
    - CVE-2024-38594: net: stmmac: move the EST lock to struct stmmac_priv (bsc#1226734).
    - CVE-2024-38569: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group (bsc#1226772).
    - CVE-2024-38568: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group (bsc#1226771).
    - CVE-2024-26814: vfio/fsl-mc: Block calling interrupt handler without trigger (bsc#1222810).
    - CVE-2024-26813: vfio/platform: Create persistent IRQ handlers (bsc#1222809).
    - CVE-2024-36945: net/smc: fix neighbour and rtable leak in smc_ib_find_route() (bsc#1225823).
    - CVE-2024-36923: fs/9p: fix uninitialized values during inode evict (bsc#1225815).
    - CVE-2024-36971: net: fix __dst_negative_advice() race (bsc#1226145).
    - CVE-2024-27414: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back (bsc#1224439).
    - CVE-2024-35886: ipv6: Fix infinite recursion in fib6_dump_done() (bsc#1224670).
    - CVE-2024-36024: drm/amd/display: Disable idle reallow as part of command/gpint execution (bsc#1225702).
    - CVE-2024-36903: ipv6: Fix potential uninit-value access in __ip6_make_skb() (bsc#1225741).
    - CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225737).
    - CVE-2024-35979: raid1: fix use-after-free for original bio in raid1_write_request() (bsc#1224572).
    - CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
    - CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
    - CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
    - CVE-2024-35898: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()     (bsc#1224498).
    - CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
    - CVE-2024-36882: mm: use memalloc_nofs_save() in page_cache_ra_order() (bsc#1225723).
    - CVE-2024-36916: blk-iocost: avoid out of bounds shift (bsc#1225759).
    - CVE-2024-36900: net: hns3: fix kernel crash when devlink reload during initialization (bsc#1225726).
    - CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
    - CVE-2024-35925: block: prevent division by zero in blk_rq_stat_sum() (bsc#1224661).
    - CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
    - CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
    - CVE-2024-36934: bna: ensure the copied buf is NUL terminated (bsc#1225760).
    - CVE-2024-36935: ice: ensure the copied buf is NUL terminated (bsc#1225763).
    - CVE-2024-36937: xdp: use flags field to disambiguate broadcast redirect (bsc#1225834).
    - CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
    - CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
    - CVE-2024-36005: netfilter: nf_tables: honor table dormant flag from netdev release event path     (bsc#1224539).
    - CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
    - CVE-2024-35892: net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() (bsc#1224515).
    - CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
    - CVE-2024-35884: udp: do not accept non-tunnel GSO skbs landing in a tunnel (bsc#1224520).
    - CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
    - CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
    - CVE-2024-35926: crypto: iaa - Fix async_disable descriptor leak (bsc#1224655).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
    - CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
    - CVE-2024-36008: ipv4: check for NULL idev in ip_route_use_hint() (bsc#1224540).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
    - CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2024-35880: io_uring/kbuf: hold io_buffer_list reference over mmap (bsc#1224523).
    - CVE-2024-35831: io_uring: Fix release of pinned pages when __io_uaddr_map fails (bsc#1224698).
    - CVE-2024-35827: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() (bsc#1224606).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4211 advisory.

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

    * kernel: ovl: fix leaked entry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

    * kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

    * kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

    * kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

    * kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

    * kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10]     (CVE-2024-27397)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

    * kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

    * kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804,     CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:Rocky Linux-29783)

    * Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:Rocky Linux-35361)

    * Rocky Linux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:Rocky Linux-36048)

    * [Rocky Linux8] blktests block/024 failed (JIRA:Rocky Linux-8130)

    * Rocky Linux8.9: EEH injections results  Error:  Power fault on Port 0 and other call     traces(Everest/1050/Shiner) (JIRA:Rocky Linux-14195)

    * Latency spikes with Matrox G200 graphic cards (JIRA:Rocky Linux-36172)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4352 advisory.

    * kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583

    * kernel-rt: kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)

    * kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero  (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

    * kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)

    * kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: ovl: fix leaked dentry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)

    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)

    * kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52813)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: usb: (CVE-2023-52781, CVE-2023-52877)

    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

    * kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)

    * kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)

    * kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)

    * kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)

    * kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest Rocky Linux-8.10.z kernel (JIRA:Rocky Linux-40882)

    * [rhel8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735 (JIRA:Rocky     Linux-8779)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:4352 advisory.

    * kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583
    * kernel-rt: kernel: PCI interrupt mapping cause oops [almalinux-8] (CVE-2021-46909)
    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)
    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)
    * kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)
    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)
    * kernel: Squashfs: check the inode number is not the invalid value of zero  (CVE-2024-26982)
    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)
    * kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)
    * kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)
    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)
    * kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)
    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
    * kernel: ovl: fix leaked dentry (CVE-2021-46972)
    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
    * kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)
    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)
    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
    * kernel: crypto: (CVE-2024-26974, CVE-2023-52813)
    * kernel: can: (CVE-2023-52878, CVE-2021-47456)
    * kernel: usb: (CVE-2023-52781, CVE-2023-52877)
    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
    * kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)
    * kernel: gro: fix ownership transfer (CVE-2024-35890)
    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)
    * kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)
    * kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)
    * kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)
    * kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)
    * kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)
    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest AlmaLinux-8.10.z kernel (JIRA:AlmaLinux-40882)
    * [almalinux8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735     (JIRA:AlmaLinux-8779)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4352 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583

    * kernel-rt: kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)

    * kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero  (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

    * kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)

    * kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: ovl: fix leaked dentry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)

    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)

    * kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52813)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: usb: (CVE-2023-52781, CVE-2023-52877)

    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

    * kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)

    * kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)

    * kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)

    * kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)

    * kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-8.10.z kernel (JIRA:RHEL-40882)

    * [rhel8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735     (JIRA:RHEL-8779)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4211 advisory.

    - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353}
    - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310}
    - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909}
    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004}
    - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959}
    - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960}
    - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091]     {CVE-2023-52667}
    - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958}
    - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763]     {CVE-2021-47356}
    - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763]     {CVE-2021-47356}
    - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974}
    - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974}
    - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826}
    - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735}
    - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243]     {CVE-2024-26859}
    - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090}
    - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464}
    - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311}
    - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268]     {CVE-2023-52835}
    - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813}
    - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656}
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008]     {CVE-2024-35854}
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004]     {CVE-2024-35855}
    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853}
    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016]     {CVE-2024-35852}
    - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007}
    - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456}
    - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440]     {CVE-2021-47495}
    - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
    - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835}
    - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose     Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878}
    - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236}
    - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez)     [RHEL-38113] {CVE-2023-52703}
    - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248]     {CVE-2023-52877}
    - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240]     {CVE-2023-52781}
    - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890}
    - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700}
    - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888}
    - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023]     {CVE-2024-27397}
    - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669}
    - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026]     {CVE-2024-35845}
    - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838}
    - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884]     {CVE-2024-27410}
    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez)     [RHEL-36807] {CVE-2024-35789}
    - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826]     {CVE-2024-26801}
    - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26584     CVE-2024-26583 CVE-2024-26585}
    - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096]     {CVE-2024-26982}
    - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782]     {CVE-2021-47069}
    - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582]     {CVE-2023-52626}
    - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615}
    - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058]     {CVE-2023-52686}
    - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804}
    - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162]     {CVE-2024-26907}
    - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972}
    - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166]     {CVE-2024-26906}
    - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
    - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166]     {CVE-2024-26906}
    - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
    - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
    - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
    - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644]     {CVE-2024-26759}
    - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294]     {CVE-2023-52560}
    - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790]     {CVE-2021-47073}
    - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017]     {CVE-2020-26555}
    - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675}
    - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078]     {CVE-2023-52675}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:4211 advisory.

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
    * kernel:TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)
    * kernel: ovl: fix leaked dentry (CVE-2021-46972)
    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
    * kernel: powerpc/powernv: Add a null pointer check in opal_event_init() (CVE-2023-52686)
    * kernel: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (CVE-2023-52675)
    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)
    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
    * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)
    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
    * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)
    * kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow (CVE-2024-35959)
    * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958)
    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)
    * kernel: net: ti: fix UAF in tlan_remove_one (CVE-2021-47310)

    Bug Fix(es):

    * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:AlmaLinux-29783)
    * Temporary values in FIPS integrity test should be zeroized [almalinux-8.10.z] (JIRA:AlmaLinux-35361)
    * AlmaLinux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:AlmaLinux-36048)
    * [AlmaLinux8] blktests block/024 failed (JIRA:AlmaLinux-8130)
    * AlmaLinux8.9: EEH injections results  Error:  Power fault on Port 0 and other call     traces(Everest/1050/Shiner) (JIRA:AlmaLinux-14195)
    * Latency spikes with Matrox G200 graphic cards (JIRA:AlmaLinux-36172)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4211 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

    * kernel: ovl: fix leaked entry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

    * kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

    * kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

    * kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

    * kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

    * kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10]     (CVE-2024-27397)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

    * kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

    * kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804,     CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:RHEL-29783)

    * Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:RHEL-35361)

    * RHEL8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:RHEL-36048)

    * [RHEL8] blktests block/024 failed (JIRA:RHEL-8130)

    * RHEL8.9: EEH injections results  Error:  Power fault on Port 0 and other call     traces(Everest/1050/Shiner) (JIRA:RHEL-14195)

    * Latency spikes with Matrox G200 graphic cards (JIRA:RHEL-36172)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2189-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
    - CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).
    - CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
    - CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).
    - CVE-2024-26929: Fixed double free of fcport (bsc#1223715).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-26930: Fixed double free of the ha->vp_map pointer (bsc#1223626).
    - CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).
    - CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2190-1 advisory.

    The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
    - CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
    - CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).
    - CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).
    - CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (bsc#1224621)
    - CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)
    - CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs     (bsc#1225097).
    - CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
    - CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on     (bsc#1218447).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).
    - CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
    - CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated     (bsc#1222464).
    - CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
    - CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).
    - CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
    - CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'     (bsc#1223823).
    - CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
    - CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)
    - CVE-2024-27431: Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
    - CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).
    - CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
    - CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).
    - CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).
    - CVE-2024-35860: Struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).
    - CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).
    - CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765,).
    - CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).
    - CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).
    - CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).
    - CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224020,  bsc#1224672).
    - CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).
    - CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).
    - CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
    - CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
    - CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).
    - CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).
    - CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
    - CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
    - CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
    - CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).
    - CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
    - CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).
    - CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).
    - CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2184-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets     (bsc#1220513).
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
    - CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
    - CVE-2021-47206: Check return value after calling  platform_get_resource() (bsc#1222894).
    - CVE-2021-47238: Fixed memory leak in ip_mc_add1_src  (bsc#1224847)
    - CVE-2021-47245: Fixed out of bounds when parsing TCP options  (bsc#1224838)
    - CVE-2021-47246: Fixed page reclaim for dead peer hairpin  (CVE-2021-47246 bsc#1224831).
    - CVE-2021-47249: Fixed memory leak in rds_recvmsg  (bsc#1224880)
    - CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std  (bsc#1224827)
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot  accesses (bsc#1224960).
    - CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2021-47334: Fixed two use after free in ibmasm_init_one  (bsc#1225112).
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup()  (bsc#1225141).
    - CVE-2021-47357: Fixed possible use-after-free in ia_module_exit()  (bsc#1225144).
    - CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb  (bsc#1225082)
    - CVE-2021-47401: Fixed stack information leak (bsc#1225242).
    - CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
    - CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
    - CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit()  (bsc#1224907).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes()  (CVE-2022-48672 bsc#1223931).
    - CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
    - CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
    - CVE-2022-48702: Fixed out of bounds access in  snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
    - CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (bsc#1224621)
    - CVE-2023-52730: Fixed possible resource leaks in some error paths  (bsc#1224956).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace  (bsc#1225222).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
    - CVE-2023-52864: Fixed opening of char device (bsc#1225132).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data  (bsc#1225086).
    - CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data  (bsc#1225096).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-26625: Call sock_orphan() at release time  (bsc#1221086)
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26846: Do not wait in vain when unloading module  (bsc#1223023).
    - CVE-2024-26874: Fixed a null pointer crash in (bsc#1223048)
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26957: Fixed reference counting on zcrypt card objects  (bsc#1223666).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-26984: Fixed instmem race condition around ptr stores (bsc#1223633)
    - CVE-2024-26996: Fixed UAF ncm object at re-bind after usb  ep transport error (bsc#1223752).
    - CVE-2024-27008: Fixed out of bounds access (CVE-2024-27008 bsc#1223802).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)
    - CVE-2024-27436: Stop parsing channels bits when all channels  are found (bsc#1224803).
    - CVE-2024-35789: Check fast rx for non-4addr sta VLAN  changes (bsc#1224749).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal  (bsc#1224738).
    - CVE-2024-35830: Register v4l2 async device only after  successful setup (bsc#1224680).
    - CVE-2024-35849: Fixed information leak in btrfs_ioctl_logical_to_ino()  (bsc#1224733).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2024-35887: Fixed use-after-free bugs caused by ax25_ds_del_timer  (bsc#1224663)
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT  (bsc#1224566)
    - CVE-2024-36029: Prevent access to suspended controller (bsc#1225708)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2019-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).
    - CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).
    - CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).
    - CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
    - CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).
    - CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).
    - CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).
    - CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).
    - CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
    - CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated     (bsc#1222464).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (CVE-2023-52698 bsc#1224621)
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs     (bsc#1225097).
    - CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).
    - CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).
    - CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
    - CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
    - CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
    - CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
    - CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)
    - CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).
    - CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).
    - CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).
    - CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).
    - CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
    - CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
    - CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).
    - CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
    - CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).
    - CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).
    - CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
    - CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).
    - CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).
    - CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).
    - CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).
    - CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).
    - CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).
    - CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).
    - CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
    - CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
    - CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2008-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
    - CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
    - CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).
    - CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).
    - CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (CVE-2023-52698 bsc#1224621)
    - CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)
    - CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs     (bsc#1225097).
    - CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).
    - CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
    - CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated     (bsc#1222464).
    - CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).
    - CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
    - CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
    - CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'     (bsc#1223823).
    - CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)
    - CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
    - CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).
    - CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).
    - CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).
    - CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).
    - CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).
    - CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).
    - CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).
    - CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).
    - CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
    - CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
    - CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).
    - CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
    - CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).
    - CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).
    - CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
    - CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).
    - CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).
    - CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).
    - CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
    - CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).
    - CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
    - CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).
    - CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
    - CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).
    - CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).
    - CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1983-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2022-48697: Fix a use-after-free (bsc#1223922).
    - CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
    - CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
    - CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47423: Fix file release memory leak (bsc#1225366).
    - CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
    - CVE-2021-47401: Fix stack information leak (bsc#1225242).
    - CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
    - CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2023-52864: Fix opening of char device (bsc#1225132).
    - CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
    - CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
    - CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
    - CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
    - CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
    - CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)
    - CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).
    - CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).
    - CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2024-35789: Clear fast rx for non-4addr sta VLAN changes (bsc#1224749).
    - CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).
    - CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).
    - CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bzg#1224663)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
    - CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).
    - CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26996: Fix UAF ncm object at re-bind after usb ep transport error (bsc#1223752).
    - CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)
    - CVE-2022-48702: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
    - CVE-2022-48672: Fix off-by-one error in unflatten_dt_nodes() (bsc#1223931).
    - CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
    - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets     (bsc#1220513).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-27008: Fix out of bounds access (bsc#1223802).
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1979-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it
    - CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
    - CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47423: Fix file release memory leak (bsc#1225366).
    - CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960,     CVE-2021-47277).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
    - CVE-2021-47401: Fix stack information leak (bsc#1225242).
    - CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
    - CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2023-52864: Fix opening of char device (bsc#1225132).
    - CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
    - CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
    - CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
    - CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
    - CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
    - CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)
    - CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).
    - CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).
    - CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2024-35789: Clear fast rx for non-4addr in VLAN netdev (bsc#1224749).
    - CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).
    - CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).
    - CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bsc#1224663)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
    - CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).
    - CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26996: Fix UAF ncm object at re-bind after usb transport error (bsc#1223752).
    - CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.205-195.804. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-045 advisory.

    2024-12-05: CVE-2023-52835 was added to this advisory.

    2024-12-05: CVE-2023-52781 was added to this advisory.

    2024-12-05: CVE-2023-52828 was added to this advisory.

    2024-12-05: CVE-2023-52759 was added to this advisory.

    2024-12-05: CVE-2023-52809 was added to this advisory.

    2024-12-05: CVE-2023-52791 was added to this advisory.

    2024-11-08: CVE-2023-52819 was added to this advisory.

    2024-11-08: CVE-2023-52818 was added to this advisory.

    2024-11-08: CVE-2023-52814 was added to this advisory.

    2024-08-27: CVE-2023-52654 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    2024-01-19: CVE-2023-6531 was added to this advisory.

    A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel.
    (CVE-2023-39198)

    An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-52654)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: ignore negated quota changes (CVE-2023-52759)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix potential null pointer derefernce (CVE-2023-52814)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (CVE-2023-52818)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (CVE-2023-52819)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Detect IP == ksym.end as part of BPF program (CVE-2023-52828)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double     deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

    We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.145-95.156. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-033 advisory.

    2024-12-05: CVE-2023-52772 was added to this advisory.

    2024-12-05: CVE-2023-52835 was added to this advisory.

    2024-12-05: CVE-2023-52781 was added to this advisory.

    2024-12-05: CVE-2023-52828 was added to this advisory.

    2024-12-05: CVE-2023-52788 was added to this advisory.

    2024-12-05: CVE-2023-52791 was added to this advisory.

    2024-08-27: CVE-2023-52654 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-07-03: CVE-2023-52762 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-06-06: CVE-2024-0607 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    2024-01-19: CVE-2023-6531 was added to this advisory.

    An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-52654)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-blk: fix implicit overflow on virtio_max_dma_size (CVE-2023-52762)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: fix use-after-free in unix_stream_read_actor() (CVE-2023-52772)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i915/perf: Fix NULL deref bugs with drm_dbg() calls (CVE-2023-52788)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Detect IP == ksym.end as part of BPF program (CVE-2023-52828)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double     deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

    We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

    netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-461 advisory.

    2024-12-05: CVE-2023-52843 was added to this advisory.

    2024-12-05: CVE-2023-52859 was added to this advisory.

    2024-12-05: CVE-2023-52788 was added to this advisory.

    2024-12-05: CVE-2023-52846 was added to this advisory.

    2024-12-05: CVE-2023-52868 was added to this advisory.

    2024-12-05: CVE-2023-52831 was added to this advisory.

    2024-12-05: CVE-2023-52854 was added to this advisory.

    2024-12-05: CVE-2023-52869 was added to this advisory.

    2024-12-05: CVE-2023-52772 was added to this advisory.

    2024-12-05: CVE-2023-52791 was added to this advisory.

    2024-12-05: CVE-2023-52781 was added to this advisory.

    2024-12-05: CVE-2023-52835 was added to this advisory.

    2024-12-05: CVE-2023-52828 was added to this advisory.

    2024-11-13: CVE-2023-52752 was added to this advisory.

    2024-07-03: CVE-2023-52840 was added to this advisory.

    2024-07-03: CVE-2023-6622 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-07-03: CVE-2023-52762 was added to this advisory.

    2024-06-19: CVE-2023-52860 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52778 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-02-01: CVE-2024-0607 was added to this advisory.

    2024-01-03: CVE-2023-6932 was added to this advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (CVE-2023-52752)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-blk: fix implicit overflow on virtio_max_dma_size (CVE-2023-52762)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: fix use-after-free in unix_stream_read_actor() (CVE-2023-52772)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: deal with large GSO size (CVE-2023-52778)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i915/perf: Fix NULL deref bugs with drm_dbg() calls (CVE-2023-52788)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Detect IP == ksym.end as part of BPF program (CVE-2023-52828)

    In the Linux kernel, the following vulnerability has been resolved:

    cpu/hotplug: Don't offline the last non-isolated CPU (CVE-2023-52831)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CVE-2023-52840)

    In the Linux kernel, the following vulnerability has been resolved:

    llc: verify mac len before reading mac header (CVE-2023-52843)

    In the Linux kernel, the following vulnerability has been resolved:

    hsr: Prevent use after free in prp_create_tagged_frame() (CVE-2023-52846)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: Fix refcnt handling in padata_free_shell() (CVE-2023-52854)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: hisi: Fix use-after-free when register pmu fails (CVE-2023-52859)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process     (CVE-2023-52860)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: prevent potential string overflow (CVE-2023-52868)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/platform: Add check for kstrdup (CVE-2023-52869)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the     argument sync is true, making it possible to free a catchall set element many times.

    We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. (CVE-2023-6111)

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

    netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209785	EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2024-2781)	Nessus	Huawei Local Security Checks	high
209777	EulerOS Virtualization 2.12.1 : kernel (EulerOS-SA-2024-2763)	Nessus	Huawei Local Security Checks	high
208398	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2024-2585)	Nessus	Huawei Local Security Checks	high
208356	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2024-2559)	Nessus	Huawei Local Security Checks	high
208351	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-2519)	Nessus	Huawei Local Security Checks	high
208330	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-2544)	Nessus	Huawei Local Security Checks	high
206008	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2973-1)	Nessus	SuSE Local Security Checks	high
205492	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2896-1)	Nessus	SuSE Local Security Checks	high
202999	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2571-1)	Nessus	SuSE Local Security Checks	high
202388	Rocky Linux 8 : kernel (RLSA-2024:4211)	Nessus	Rocky Linux Local Security Checks	high
202379	Rocky Linux 8 : kernel-rt (RLSA-2024:4352)	Nessus	Rocky Linux Local Security Checks	high
202069	AlmaLinux 8 : kernel-rt (ALSA-2024:4352)	Nessus	Alma Linux Local Security Checks	high
201943	RHEL 8 : kernel-rt (RHSA-2024:4352)	Nessus	Red Hat Local Security Checks	high
201306	Oracle Linux 8 : kernel (ELSA-2024-4211)	Nessus	Oracle Linux Local Security Checks	high
201236	AlmaLinux 8 : kernel (ALSA-2024:4211)	Nessus	Alma Linux Local Security Checks	high
201233	RHEL 8 : kernel (RHSA-2024:4211)	Nessus	Red Hat Local Security Checks	high
201035	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2189-1)	Nessus	SuSE Local Security Checks	critical
201009	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2190-1)	Nessus	SuSE Local Security Checks	critical
200931	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2024:2184-1)	Nessus	SuSE Local Security Checks	high
200508	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2019-1)	Nessus	SuSE Local Security Checks	critical
200462	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2008-1)	Nessus	SuSE Local Security Checks	critical
200410	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1983-1)	Nessus	SuSE Local Security Checks	high
200401	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1979-1)	Nessus	SuSE Local Security Checks	high
187779	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-045)	Nessus	Amazon Linux Local Security Checks	high
187777	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-033)	Nessus	Amazon Linux Local Security Checks	high
186974	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-461)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-52781

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical

high

critical

critical

high

high

high

high

high