In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries. To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb. This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2184-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets     (bsc#1220513).
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
    - CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
    - CVE-2021-47206: Check return value after calling  platform_get_resource() (bsc#1222894).
    - CVE-2021-47238: Fixed memory leak in ip_mc_add1_src  (bsc#1224847)
    - CVE-2021-47245: Fixed out of bounds when parsing TCP options  (bsc#1224838)
    - CVE-2021-47246: Fixed page reclaim for dead peer hairpin  (CVE-2021-47246 bsc#1224831).
    - CVE-2021-47249: Fixed memory leak in rds_recvmsg  (bsc#1224880)
    - CVE-2021-47250: Fixed memory leak in netlbl_cipsov4_add_std  (bsc#1224827)
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot  accesses (bsc#1224960).
    - CVE-2021-47281: Fixed race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2021-47334: Fixed two use after free in ibmasm_init_one  (bsc#1225112).
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2021-47355: Fixed possible use-after-free in nicstar_cleanup()  (bsc#1225141).
    - CVE-2021-47357: Fixed possible use-after-free in ia_module_exit()  (bsc#1225144).
    - CVE-2021-47361: Fixed error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb  (bsc#1225082)
    - CVE-2021-47401: Fixed stack information leak (bsc#1225242).
    - CVE-2021-47423: Fixed file release memory leak (bsc#1225366).
    - CVE-2021-47431: Fixed gart.bo pin_count leak (bsc#1225390).
    - CVE-2021-47469: Add SPI fix commit to be ignored (bsc#1225347)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit()  (bsc#1224907).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2022-48672: Fixed off-by-one error in unflatten_dt_nodes()  (CVE-2022-48672 bsc#1223931).
    - CVE-2022-48686: Fixed UAF when detecting digest errors (bsc#1223948).
    - CVE-2022-48697: Fixed a use-after-free (bsc#1223922).
    - CVE-2022-48702: Fixed out of bounds access in  snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2022-48708: Fixed potential NULL dereference (bsc#1224942).
    - CVE-2022-48710: Fixed a possible null pointer dereference (bsc#1225230).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).
    - CVE-2023-52691: Fixed a double-free in si_dpm_init (bsc#1224607).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (bsc#1224621)
    - CVE-2023-52730: Fixed possible resource leaks in some error paths  (bsc#1224956).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace  (bsc#1225222).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
    - CVE-2023-52864: Fixed opening of char device (bsc#1225132).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data  (bsc#1225086).
    - CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data  (bsc#1225096).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-26625: Call sock_orphan() at release time  (bsc#1221086)
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2024-26846: Do not wait in vain when unloading module  (bsc#1223023).
    - CVE-2024-26874: Fixed a null pointer crash in (bsc#1223048)
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2024-26957: Fixed reference counting on zcrypt card objects  (bsc#1223666).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2024-26984: Fixed instmem race condition around ptr stores (bsc#1223633)
    - CVE-2024-26996: Fixed UAF ncm object at re-bind after usb  ep transport error (bsc#1223752).
    - CVE-2024-27008: Fixed out of bounds access (CVE-2024-27008 bsc#1223802).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)
    - CVE-2024-27436: Stop parsing channels bits when all channels  are found (bsc#1224803).
    - CVE-2024-35789: Check fast rx for non-4addr sta VLAN  changes (bsc#1224749).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in  svm_register_enc_region() (bsc#1224725).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal  (bsc#1224738).
    - CVE-2024-35830: Register v4l2 async device only after  successful setup (bsc#1224680).
    - CVE-2024-35849: Fixed information leak in btrfs_ioctl_logical_to_ino()  (bsc#1224733).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).
    - CVE-2024-35887: Fixed use-after-free bugs caused by ax25_ds_del_timer  (bsc#1224663)
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT  (bsc#1224566)
    - CVE-2024-36029: Prevent access to suspended controller (bsc#1225708)

    The following non-security bugs were fixed:

    - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
    - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).
    - assoc_array: Fix BUG_ON during garbage collect.
    - autofs: fix a leak in autofs_expire_indirect() (git-fixes)
    - Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working (git-fixes).
    - btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes)
    - btrfs: check if root is readonly while setting security xattr (git-fixes)
    - btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes)
    - btrfs: do not get an EINTR during drop_snapshot for reloc (git-fixes)
    - btrfs: do not stop integrity writeback too early (git-fixes)
    - btrfs: Explicitly handle btrfs_update_root failure (git-fixes)
    - btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP (git-fixes)
    - btrfs: fix btrfs_prev_leaf() to not return the same key twice (git-fixes)
    - btrfs: fix deadlock when writing out space cache (git-fixes)
    - Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes)
    - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
    - btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes)
    - btrfs: Fix NULL pointer exception in find_bio_stripe (git-fixes)
    - btrfs: Fix out of bounds access in btrfs_search_slot (git-fixes)
    - btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes)
    - btrfs: fix range_end calculation in extent_write_locked_range (git-fixes)
    - btrfs: fix return value mixup in btrfs_get_extent (git-fixes)
    - btrfs: fix unaligned access in readdir (git-fixes)
    - btrfs: limit device extents to the device size (git-fixes)
    - btrfs: prevent to set invalid default subvolid (git-fixes)
    - btrfs: record delayed inode root in transaction (git-fixes)
    - btrfs: scrub: reject unsupported scrub flags (git-fixes)
    - btrfs: send: ensure send_fd is writable (git-fixes)
    - btrfs: send: in case of IO error log it (git-fixes)
    - btrfs: send: limit number of clones and allocated memory size (git-fixes)
    - btrfs: sysfs: use NOFS for device creation (git-fixes) Adjustment: add #include
    - btrfs: tree-checker: add missing return after error in root_item (git-fixes)
    - btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes)
    - btrfs: tree-checker: do not error out if extent ref hash does not match (git-fixes)
    - btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
    - btrfs: tree-checker: Fix misleading group system information (git-fixes)
    - btrfs: undo writable superblocke when sprouting fails (git-fixes)
    - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl (git-fixes)
    - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() (git-fixes)
    - ecryptfs: fix a memory leak bug in parse_tag_1_packet() (git-fixes)
    - ecryptfs: fix kernel panic with null dev_name (git-fixes)
    - ecryptfs: Fix typo in message (git-fixes)
    - ep_create_wakeup_source(): dentry name can change under you (git-fixes)
    - exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes)
    - fscrypt: clean up some BUG_ON()s in block encryption/decryption (git-fixes)
    - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes)
    - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (git-fixes).
    - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (git-fixes).
    - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).
    - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1225059).
    - l2tp: pass correct message length to ip6_append_data (git-fixes).
    - lib/mpi: use kcalloc in mpi_resize (git-fixes).
    - list: fix a data-race around ep->rdllist (git-fixes).
    - livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).
    - mass-cve: Add convenience KBUILD_USER environment variable
    - mass-cve: Always use bash in Makefile Some constrcts are just too convenient to leave them in favor of     POSIX'd /bin/sh. Switch to explicit bash.
    - mass-cve: Fail early without data files curl >$@ would create/update the file even if download fails.
    Use explicit argument to prevent continuation with empty cve2bugzilla file.
    - mass-cve: Fix update detection with packed-refs Per-branch files are thing of the past, git may non-     deterministically pack the ref files. Therefore use the timestamp of the whole packed-ref file (better     false positive detection of update than breakage or false negative). Add unified approach to read packed-     refs regardless of KSOURCE_GIT worktree or not.
    - mass-cve: Make BRANCH mandatory
    - mass-cve: Use dedicated worktree for reference updates So that any checkout in KSOURCE_GIT is not     changed.
    - net: 9p: avoid freeing uninit memory in p9pdu_vreadf (git-fixes).
    - netfilter: nf_queue: augment nfqa_cfg_policy (git-fixes).
    - netfilter: nft_compat: explicitly reject ERROR and standard target (git-fixes).
    - netfilter: x_tables: set module owner for icmp(6) matches (git-fixes).
    - net/smc: fix fallback failed while sendmsg with fastopen (git-fixes).
    - net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).
    - net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
    - net: usb: ax88179_178a: stop lying about skb->truesize (git-fixes).
    - net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
    - net: usb: sr9700: stop lying about skb->truesize (git-fixes).
    - net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).
    - nfc: change order inside nfc_se_io error path (git-fixes).
    - powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).
    - ppdev: Add an error check in register_device (git-fixes).
    - printk: Disable passing console lock owner completely during panic() (bsc#1197894).
    - printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1223969).
    - rds: avoid unenecessary cong_update in loop transport (git-fixes).
    - rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp (git-fixes).
    - ring-buffer: Clean ring_buffer_poll_wait() error return (git-fixes).
    - ring-buffer: Fix a race between readers and resize checks (bsc#1222893).
    - rxrpc: Do not put crypto buffers on the stack (git-fixes).
    - rxrpc: Fix a memory leak in rxkad_verify_response() (git-fixes).
    - rxrpc: Provide a different lockdep key for call->user_mutex for kernel calls (git-fixes).
    - rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing (git-fixes).
    - rxrpc: Work around usercopy check (git-fixes).
    - s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224347).
    - s390/pci: fix max size calculation in zpci_memcpy_toio() (git-fixes bsc#1225062).
    - scripts/check-kernel-fix: add -F parameter
    - scripts/check-kernel-fix: avoid rechecking child branches when parents are OK Topological sorted     dependency tree allows to optimize check-kernel-fixe in cases where parent already has the fix. There is     not reason to check branches which merge from that branch as they will get the fix eventually.
    - scripts/check-kernel-fix: print a message when no action is needed. Script exits without printing     anything about the actions necessary in non-verbose mode. This can be confusing to a beginner user.
    - scripts/common-functions: for_each_build_branch traverse branches in dependency topo sorted list
    - scripts/common-functions: There are cases where Fixes tag is incorrect. Example would be bsc1223062     comment 3.
    - scripts/cve_tools: Update README Issue was fixed in ad3235427c3
    - scripts/git_sort/git_sort.py: add rafael/linux-pm.git#linux-next to remotes
    - scripts/log2: Fix References: update detection The following change -REferences: git-fixes +REferences:
    git-fixes bsc#123456 (note the typo in E) will not be detected as a reference update and generates a     commit message like
    - scripts/PMU: Always use 12 digits for abbreviated hash references Kernel developers tend to use 12     digits for abbreviated hash references as this is mandatory for upstream work. Enforce this count in PMU     for consistency.
    - tcp: tcp_make_synack() can be called from process context (git-fixes).
    - tls: Fix context leak on tls_device_down (bsc#1221545).
    - tracing: Fix blocked reader of snapshot buffer (git-fixes).
    - tracing: hide unused ftrace_event_id_fops (git-fixes).
    - tracing: Use .flush() call to wake up readers (git-fixes).
    - tracing: Use strncpy instead of memcpy when copying comm in trace.c (git-fixes).
    - tty/sysrq: replace smp_processor_id() with get_cpu() (bsc#1223540).
    - usb: aqc111: stop lying about skb->truesize (git-fixes).
    - wifi: cfg80211: avoid leaking stack data into trace (git-fixes).
    - wifi: radiotap: fix kernel-doc notation warnings (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1983-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948).
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2022-48697: Fix a use-after-free (bsc#1223922).
    - CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222).
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2021-47548: Fixed a possible array out-of-bounds (bsc#1225506)
    - CVE-2024-36029: Pervent access to suspended controller (bsc#1225708)
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
    - CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47423: Fix file release memory leak (bsc#1225366).
    - CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
    - CVE-2021-47401: Fix stack information leak (bsc#1225242).
    - CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
    - CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2023-52864: Fix opening of char device (bsc#1225132).
    - CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
    - CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
    - CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
    - CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
    - CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
    - CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)
    - CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).
    - CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).
    - CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2024-35789: Clear fast rx for non-4addr sta VLAN changes (bsc#1224749).
    - CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).
    - CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).
    - CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bzg#1224663)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
    - CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).
    - CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26996: Fix UAF ncm object at re-bind after usb ep transport error (bsc#1223752).
    - CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)
    - CVE-2022-48702: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() (bsc#1223923).
    - CVE-2022-48672: Fix off-by-one error in unflatten_dt_nodes() (bsc#1223931).
    - CVE-2021-47113: Abort btrfs rename_exchange if we fail to insert the second ref (bsc#1221543).
    - CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
    - CVE-2021-47131: Fixed a use-after-free after the TLS device goes down and up (bsc#1221545).
    - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets     (bsc#1220513).
    - CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init     in net/sctp/socket.c (bsc#1218917).
    - CVE-2024-27008: Fix out of bounds access (bsc#1223802).
    - CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).

    The following non-security bugs were fixed:

    - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
    - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).
    - assoc_array: Fix BUG_ON during garbage collect.
    - autofs: fix a leak in autofs_expire_indirect() (git-fixes)
    - Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working (git-fixes).
    - btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes)
    - btrfs: check if root is readonly while setting security xattr (git-fixes)
    - btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes)
    - btrfs: do not get an EINTR during drop_snapshot for reloc (git-fixes)
    - btrfs: do not stop integrity writeback too early (git-fixes)
    - btrfs: Explicitly handle btrfs_update_root failure (git-fixes)
    - btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP (git-fixes)
    - btrfs: fix btrfs_prev_leaf() to not return the same key twice (git-fixes)
    - btrfs: fix deadlock when writing out space cache (git-fixes)
    - Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes)
    - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
    - btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes)
    - btrfs: Fix NULL pointer exception in find_bio_stripe (git-fixes)
    - btrfs: Fix out of bounds access in btrfs_search_slot (git-fixes)
    - btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes)
    - btrfs: fix range_end calculation in extent_write_locked_range (git-fixes)
    - btrfs: fix return value mixup in btrfs_get_extent (git-fixes)
    - btrfs: fix unaligned access in readdir (git-fixes)
    - btrfs: limit device extents to the device size (git-fixes)
    - btrfs: prevent to set invalid default subvolid (git-fixes)
    - btrfs: record delayed inode root in transaction (git-fixes)
    - btrfs: scrub: reject unsupported scrub flags (git-fixes)
    - btrfs: send: ensure send_fd is writable (git-fixes)
    - btrfs: send: in case of IO error log it (git-fixes)
    - btrfs: send: limit number of clones and allocated memory size (git-fixes)
    - btrfs: sysfs: use NOFS for device creation (git-fixes) Adjustment: add #include
    - btrfs: tree-checker: add missing return after error in root_item (git-fixes)
    - btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes)
    - btrfs: tree-checker: do not error out if extent ref hash does not match (git-fixes)
    - btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
    - btrfs: tree-checker: Fix misleading group system information (git-fixes)
    - btrfs: undo writable superblocke when sprouting fails (git-fixes)
    - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl (git-fixes)
    - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() (git-fixes)
    - ecryptfs: fix a memory leak bug in parse_tag_1_packet() (git-fixes)
    - ecryptfs: fix kernel panic with null dev_name (git-fixes)
    - ecryptfs: Fix typo in message (git-fixes)
    - ep_create_wakeup_source(): dentry name can change under you (git-fixes)
    - exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes)
    - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes)
    - fscrypt: clean up some BUG_ON()s in block encryption/decryption (git-fixes)
    - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (git-fixes).
    - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (git-fixes).
    - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).
    - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1225059).
    - l2tp: pass correct message length to ip6_append_data (git-fixes).
    - lib/mpi: use kcalloc in mpi_resize (git-fixes).
    - list: fix a data-race around ep->rdllist (git-fixes).
    - net: 9p: avoid freeing uninit memory in p9pdu_vreadf (git-fixes).
    - net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).
    - net: usb: ax88179_178a: stop lying about skb->truesize (git-fixes).
    - net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
    - net: usb: sr9700: stop lying about skb->truesize (git-fixes).
    - net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).
    - net/smc: fix fallback failed while sendmsg with fastopen (git-fixes).
    - net/tls: Remove the context from the list in tls_device_down (bsc#1221545).
    - netfilter: nf_queue: augment nfqa_cfg_policy (git-fixes).
    - netfilter: nft_compat: explicitly reject ERROR and standard target (git-fixes).
    - netfilter: x_tables: set module owner for icmp(6) matches (git-fixes).
    - nfc: change order inside nfc_se_io error path (git-fixes).
    - powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).
    - ppdev: Add an error check in register_device (git-fixes).
    - printk: Disable passing console lock owner completely during panic() (bsc#1197894).
    - printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1223969).
    - rds: avoid unenecessary cong_update in loop transport (git-fixes).
    - rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp (git-fixes).
    - ring-buffer: Clean ring_buffer_poll_wait() error return (git-fixes).
    - ring-buffer: Fix a race between readers and resize checks (bsc#1222893).
    - rxrpc: Do not put crypto buffers on the stack (git-fixes).
    - rxrpc: Fix a memory leak in rxkad_verify_response() (git-fixes).
    - rxrpc: Provide a different lockdep key for call->user_mutex for kernel calls (git-fixes).
    - rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing (git-fixes).
    - rxrpc: Work around usercopy check (git-fixes).
    - s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224347).
    - s390/pci: fix max size calculation in zpci_memcpy_toio() (git-fixes bsc#1225062).
    - tcp: tcp_make_synack() can be called from process context (git-fixes).
    - tls: Fix context leak on tls_device_down (bsc#1221545).
    - tracing: Fix blocked reader of snapshot buffer (git-fixes).
    - tracing: hide unused ftrace_event_id_fops (git-fixes).
    - tracing: Use .flush() call to wake up readers (git-fixes).
    - tracing: Use strncpy instead of memcpy when copying comm in trace.c (git-fixes).
    - tty/sysrq: replace smp_processor_id() with get_cpu() (bsc#1223540).
    - usb: aqc111: stop lying about skb->truesize (git-fixes).
    - wifi: cfg80211: avoid leaking stack data into trace (git-fixes).
    - wifi: radiotap: fix kernel-doc notation warnings (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1979-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
    - CVE-2022-48686: Fix UAF when detecting digest errors (bsc#1223948). Update blacklist.conf: remove entry
    - CVE-2021-47074: Fixed memory leak in nvme_loop_create_ctrl() (bsc#1220854).
    - CVE-2021-47378: Destroy cm id before destroy qp to avoid use after free (bsc#1225201).
    - CVE-2022-48697: Fix a use-after-free (bsc#1223922). Update blacklist.conf: drop entry from it
    - CVE-2024-26846: Do not wait in vain when unloading module (bsc#1223023).
    - CVE-2021-47496: Fix flipped sign in tls_err_abort() calls (bsc#1225354)
    - CVE-2023-42755: Check user supplied offsets (bsc#1215702).
    - CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2021-47246: Fix page reclaim for dead peer hairpin (bsc#1224831).
    - CVE-2023-52732: Blocklist the kclient when receiving corrupted snap trace (bsc#1225222 CVE-2023-52732).
    - CVE-2024-35936: Add missing mutex_unlock in btrfs_relocate_sys_chunks() (bsc#1224644)
    - CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
    - CVE-2024-36029: Pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2021-47352: Add validation for used length (bsc#1225124).
    - CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
    - CVE-2021-47431: Fix gart.bo pin_count leak (bsc#1225390).
    - CVE-2024-35935: Handle path ref underflow in header iterate_inode_ref() (bsc#1224645)
    - CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
    - CVE-2021-47423: Fix file release memory leak (bsc#1225366).
    - CVE-2022-48710: Fix a possible null pointer dereference (bsc#1225230).
    - CVE-2021-47497: Fixed shift-out-of-bound (UBSAN) with byte size cells (bsc#1225355).
    - CVE-2024-35932: Do not check if plane->state->fb == state->fb (bsc#1224650).
    - CVE-2021-47500: Fixed trigger reference couting (bsc#1225360).
    - CVE-2024-35809: Drain runtime-idle callbacks before driver removal (bsc#1224738).
    - CVE-2021-47383: Fiedx out-of-bound vmalloc access in imageblit (bsc#1225208).
    - CVE-2021-47511: Fixed negative period/buffer sizes (bsc#1225411).
    - CVE-2021-47509: Limit the period size to 16MB (bsc#1225409).
    - CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
    - CVE-2024-35982: Avoid infinite loop trying to resize local TT (bsc#1224566)
    - CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
    - CVE-2021-47277: Avoid speculation-based attacks from out-of-range memslot accesses (bsc#1224960,     CVE-2021-47277).
    - CVE-2024-35791: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (bsc#1224725).
    - CVE-2021-47401: Fix stack information leak (bsc#1225242).
    - CVE-2023-52867: Fix possible buffer overflow (bsc#1225009).
    - CVE-2023-52821: Fix a possible null pointer dereference (bsc#1225022).
    - CVE-2021-47265: Verify port when creating flow rule (bsc#1224957)
    - CVE-2021-47362: Update intermediate power state for SI (bsc#1225153).
    - CVE-2021-47361: Fix error handling in mcb_alloc_bus() (bsc#1225151).
    - CVE-2023-52864: Fix opening of char device (bsc#1225132).
    - CVE-2022-48708: Fix potential NULL dereference (bsc#1224942).
    - CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host() (bsc#1224648).
    - CVE-2021-47238: Fix memory leak in ip_mc_add1_src (bsc#1224847)
    - CVE-2023-52730: Fix possible resource leaks in some error paths (bsc#1224956).
    - CVE-2021-47355: Fix possible use-after-free in nicstar_cleanup() (bsc#1225141).
    - CVE-2021-47245: Fix out of bounds when parsing TCP options (bsc#1224838)
    - CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf() (bsc#1224671).
    - CVE-2023-52747: Restore allocated resources on failed copyout (bsc#1224931)
    - CVE-2021-47249: Fix memory leak in rds_recvmsg (bsc#1224880)
    - CVE-2021-47397: Break out if skb_header_pointer returns NULL in sctp_rcv_ootb (bsc#1225082)
    - CVE-2021-47250: Fix memory leak in netlbl_cipsov4_add_std (bsc#1224827)
    - CVE-2024-35849: Fix information leak in btrfs_ioctl_logical_to_ino() (bsc#1224733).
    - CVE-2024-27436: Stop parsing channels bits when all channels are found (bsc#1224803).
    - CVE-2021-47281: Fix race of snd_seq_timer_open() (bsc#1224983).
    - CVE-2024-35789: Clear fast rx for non-4addr in VLAN netdev (bsc#1224749).
    - CVE-2024-35830: Register v4l2 async device only after successful setup (bsc#1224680).
    - CVE-2021-47334: Fix two use after free in ibmasm_init_one (bsc#1225112).
    - CVE-2021-47357: Fix possible use-after-free in ia_module_exit() (bsc#1225144).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2024-35887: Fix use-after-free bugs caused by ax25_ds_del_timer (bsc#1224663)
    - CVE-2021-47483: Fixed possible double-free in regcache_rbtree_exit() (bsc#1224907).
    - CVE-2024-26957: Fix reference counting on zcrypt card objects (bsc#1223666).
    - CVE-2023-52691: Fix a double-free in si_dpm_init (bsc#1224607).
    - CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
    - CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
    - CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).
    - CVE-2024-26984: Fix instmem race condition around ptr stores (bsc#1223633)
    - CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
    - CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
    - CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
    - CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
    - CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
    - CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
    - CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
    - CVE-2022-48704: Add a force flush to delay work when radeon (bsc#1223932)
    - CVE-2021-47206: Check return value after calling platform_get_resource() (bsc#1222894).
    - CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
    - CVE-2024-26996: Fix UAF ncm object at re-bind after usb transport error (bsc#1223752).
    - CVE-2024-26874: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip (bsc#1223048)
    - CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).

    The following non-security bugs were fixed:

    - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
    - af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
    - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
    - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).
    - assoc_array: Fix BUG_ON during garbage collect.
    - autofs: fix a leak in autofs_expire_indirect() (git-fixes)
    - Bluetooth: btusb: Some Qualcomm Bluetooth adapters stop working (git-fixes).
    - btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes)
    - btrfs: check if root is readonly while setting security xattr (git-fixes)
    - btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes)
    - btrfs: do not get an EINTR during drop_snapshot for reloc (git-fixes)
    - btrfs: do not stop integrity writeback too early (git-fixes)
    - btrfs: Explicitly handle btrfs_update_root failure (git-fixes)
    - btrfs: fail mount when sb flag is not in BTRFS_SUPER_FLAG_SUPP (git-fixes)
    - btrfs: fix btrfs_prev_leaf() to not return the same key twice (git-fixes)
    - btrfs: fix deadlock when writing out space cache (git-fixes)
    - Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes)
    - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
    - btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes)
    - btrfs: Fix NULL pointer exception in find_bio_stripe (git-fixes)
    - btrfs: Fix out of bounds access in btrfs_search_slot (git-fixes)
    - btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes)
    - btrfs: fix range_end calculation in extent_write_locked_range (git-fixes)
    - btrfs: fix return value mixup in btrfs_get_extent (git-fixes)
    - btrfs: fix unaligned access in readdir (git-fixes)
    - btrfs: limit device extents to the device size (git-fixes)
    - btrfs: prevent to set invalid default subvolid (git-fixes)
    - btrfs: record delayed inode root in transaction (git-fixes)
    - btrfs: scrub: reject unsupported scrub flags (git-fixes)
    - btrfs: send: ensure send_fd is writable (git-fixes)
    - btrfs: send: in case of IO error log it (git-fixes)
    - btrfs: send: limit number of clones and allocated memory size (git-fixes)
    - btrfs: sysfs: use NOFS for device creation (git-fixes) Adjustment: add #include
    - btrfs: tree-checker: add missing return after error in root_item (git-fixes)
    - btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes)
    - btrfs: tree-checker: do not error out if extent ref hash does not match (git-fixes)
    - btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
    - btrfs: tree-checker: Fix misleading group system information (git-fixes)
    - btrfs: undo writable superblocke when sprouting fails (git-fixes)
    - btrfs: validate qgroup inherit for SNAP_CREATE_V2 ioctl (git-fixes)
    - ecryptfs: fix a memory leak bug in ecryptfs_init_messaging() (git-fixes)
    - ecryptfs: fix a memory leak bug in parse_tag_1_packet() (git-fixes)
    - ecryptfs: fix kernel panic with null dev_name (git-fixes)
    - ecryptfs: Fix typo in message (git-fixes)
    - ep_create_wakeup_source(): dentry name can change under you (git-fixes)
    - exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes)
    - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes)
    - fscrypt: clean up some BUG_ON()s in block encryption/decryption (git-fixes)
    - ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() (git-fixes).
    - ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() (git-fixes).
    - kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).
    - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1225059).
    - l2tp: pass correct message length to ip6_append_data (git-fixes).
    - lib/mpi: use kcalloc in mpi_resize (git-fixes).
    - list: fix a data-race around ep->rdllist (git-fixes).
    - net: 9p: avoid freeing uninit memory in p9pdu_vreadf (git-fixes).
    - net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).
    - net: usb: ax88179_178a: stop lying about skb->truesize (git-fixes).
    - net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
    - net: usb: sr9700: stop lying about skb->truesize (git-fixes).
    - net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).
    - net/smc: fix fallback failed while sendmsg with fastopen (git-fixes).
    - netfilter: nf_queue: augment nfqa_cfg_policy (git-fixes).
    - netfilter: nft_compat: explicitly reject ERROR and standard target (git-fixes).
    - netfilter: x_tables: set module owner for icmp(6) matches (git-fixes).
    - nfc: change order inside nfc_se_io error path (git-fixes).
    - powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).
    - ppdev: Add an error check in register_device (git-fixes).
    - rds: avoid unenecessary cong_update in loop transport (git-fixes).
    - rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp (git-fixes).
    - ring-buffer: Clean ring_buffer_poll_wait() error return (git-fixes).
    - ring-buffer: Fix a race between readers and resize checks (bsc#1222893).
    - rxrpc: Do not put crypto buffers on the stack (git-fixes).
    - rxrpc: Fix a memory leak in rxkad_verify_response() (git-fixes).
    - rxrpc: Provide a different lockdep key for call->user_mutex for kernel calls (git-fixes).
    - rxrpc: The mutex lock returned by rxrpc_accept_call() needs releasing (git-fixes).
    - rxrpc: Work around usercopy check (git-fixes).
    - s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224347).
    - s390/pci: fix max size calculation in zpci_memcpy_toio() (git-fixes bsc#1225062).
    - tcp: tcp_make_synack() can be called from process context (git-fixes).
    - tracing: Fix blocked reader of snapshot buffer (git-fixes).
    - tracing: hide unused ftrace_event_id_fops (git-fixes).
    - tracing: Use .flush() call to wake up readers (git-fixes).
    - tracing: Use strncpy instead of memcpy when copying comm in trace.c (git-fixes).
    - usb: aqc111: stop lying about skb->truesize (git-fixes).
    - wifi: cfg80211: avoid leaking stack data into trace (git-fixes).
    - wifi: radiotap: fix kernel-doc notation warnings (git-fixes).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.205-195.804. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-045 advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    2024-01-19: CVE-2023-6531 was added to this advisory.

    A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel.
    (CVE-2023-39198)

    An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double     deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

    We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.145-95.156. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-033 advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-07-03: CVE-2023-52762 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-06-06: CVE-2024-0607 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    2024-01-19: CVE-2023-6531 was added to this advisory.

    An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-blk: fix implicit overflow on virtio_max_dma_size (CVE-2023-52762)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double     deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

    We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

    netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-461 advisory.

    2024-07-03: CVE-2023-52840 was added to this advisory.

    2024-07-03: CVE-2023-6622 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-07-03: CVE-2023-52762 was added to this advisory.

    2024-06-19: CVE-2023-52860 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52778 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-02-01: CVE-2024-0607 was added to this advisory.

    2024-01-03: CVE-2023-6932 was added to this advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-blk: fix implicit overflow on virtio_max_dma_size (CVE-2023-52762)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: deal with large GSO size (CVE-2023-52778)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CVE-2023-52840)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process     (CVE-2023-52860)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the     argument sync is true, making it possible to free a catchall set element many times.

    We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. (CVE-2023-6111)

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

    netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201009	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2190-1)	Nessus	SuSE Local Security Checks	critical
200931	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2024:2184-1)	Nessus	SuSE Local Security Checks	high
200508	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2019-1)	Nessus	SuSE Local Security Checks	critical
200462	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2008-1)	Nessus	SuSE Local Security Checks	critical
200410	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1983-1)	Nessus	SuSE Local Security Checks	high
200401	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1979-1)	Nessus	SuSE Local Security Checks	high
187779	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-045)	Nessus	Amazon Linux Local Security Checks	high
187777	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-033)	Nessus	Amazon Linux Local Security Checks	high
186974	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-461)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-52803

medium

Tenable Plugins

critical

high

critical

critical

high

high

high

high

high