In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATA_RESET We found a hungtask bug in test_aead_vec_cfg as follows: INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Call trace: __switch_to+0x98/0xe0 __schedule+0x6c4/0xf40 schedule+0xd8/0x1b4 schedule_timeout+0x474/0x560 wait_for_common+0x368/0x4e0 wait_for_completion+0x20/0x30 wait_for_completion+0x20/0x30 test_aead_vec_cfg+0xab4/0xd50 test_aead+0x144/0x1f0 alg_test_aead+0xd8/0x1e0 alg_test+0x634/0x890 cryptomgr_test+0x40/0x70 kthread+0x1e0/0x220 ret_from_fork+0x10/0x18 Kernel panic - not syncing: hung_task: blocked tasks For padata_do_parallel, when the return err is 0 or -EBUSY, it will call wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal case, aead_request_complete() will be called in pcrypt_aead_serial and the return err is 0 for padata_do_parallel. But, when pinst->flags is PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it won't call aead_request_complete(). Therefore, test_aead_vec_cfg will hung at wait_for_completion(&wait->completion), which will cause hungtask. The problem comes as following: (padata_do_parallel) | rcu_read_lock_bh(); | err = -EINVAL; | (padata_replace) | pinst->flags |= PADATA_RESET; err = -EBUSY | if (pinst->flags & PADATA_RESET) | rcu_read_unlock_bh() | return err In order to resolve the problem, we replace the return err -EBUSY with -EAGAIN, which means parallel_data is changing, and the caller should call it again. v3: remove retry and just change the return err. v2: introduce padata_try_do_parallel() in pcrypt_aead_encrypt and pcrypt_aead_decrypt to solve the hungtask.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-9315 advisory.

    - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56254] {CVE-2024-43892}
    - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (Michal Schmidt) [RHEL-57259] {CVE-2024-44984}
    - dma: fix call order in dmam_free_coherent (Eder Zulian) [RHEL-54751] {CVE-2024-43856}
    - dmaengine: idxd: Avoid unnecessary destruction of file_ida (Jerry Snitselaar) [RHEL-44508]     {CVE-2024-38629}
    - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55074] {CVE-2024-42284}
    - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57119] {CVE-2024-44970}
    - net/mlx5e: Fix CT entry update leaks of modify header context (Michal Schmidt) [RHEL-55628]     {CVE-2024-43864}
    - net/mlx5: Always drain health in shutdown callback (Michal Schmidt) [RHEL-55616] {CVE-2024-43866}
    - net/mlx5: Fix missing lock on sync reset reload (Michal Schmidt) [RHEL-55121] {CVE-2024-42268}
    - ionic: fix kernel panic in XDP_TX action (CKI Backport Bot) [RHEL-47730] {CVE-2024-40907}
    - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (Izabela Bakollari) [RHEL-44037]     {CVE-2024-38586}
    - KVM: s390: fix validity interception issue when gisa is switched off (CKI Backport Bot) [RHEL-57197]     {CVE-2024-45005}
    - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (Jose Ignacio Tornos     Martinez) [RHEL-55579] {CVE-2024-43879}
    - wifi: mac80211: fix NULL dereference at band check in starting tx ba session (Jose Ignacio Tornos     Martinez) [RHEL-56191] {CVE-2024-43911}
    - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (Jose Ignacio Tornos Martinez)     [RHEL-54805] {CVE-2024-43842}
    - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51559] {CVE-2024-42079}
    - x86/mm: Fix pti_clone_pgtable() alignment assumption (Rafael Aquini) [RHEL-57170] {CVE-2024-44965}
    - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (CKI Backport     Bot) [RHEL-47822] {CVE-2024-40919}
    - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44369]     {CVE-2024-36270}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    kernel:ACPI: CPPC: Use access_width over bit_width for system memory accesses(CVE-2024-35995)

    kernel: block: fix overflow in blk_ioctl_discard()(CVE-2024-36917)

    kernel:block: prevent division by zero in blk_rq_stat_sum()(CVE-2024-35925)

    bpf: Fix stackmap overflow check on 32-bit arches(CVE-2024-26883)

    kernel:calipso: fix memory leak in netlbl_calipso_add_pass()(CVE-2023-52698)

    kernel:erspan: make sure erspan_base_hdr is present in skb-head(CVE-2024-35888)

    kernel: ext4: fix corruption during on-line resize(CVE-2024-35807)

    kernel:HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up(CVE-2024-35997)

    HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect(CVE-2023-52478)

    kernel:i2c: smbus: fix NULL function pointer dereference(CVE-2024-35984)

    kernel:i40e: Do not use WQ_MEM_RECLAIM flag for workqueue(CVE-2024-36004)

    i40e: Fix NULL ptr dereference on VSI filter sync(CVE-2021-47184)

    iavf: free q_vectors before queues in iavf_disable_vf(CVE-2021-47201)

    ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()(CVE-2024-26633)

    ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()(CVE-2024-26641)

    kernel:ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()(CVE-2024-36902)

    kernel:ipv6: Fix infinite recursion in fib6_dump_done().(CVE-2024-35886)

    kernel:ipv6: Fix potential uninit-value access in __ip6_make_skb()(CVE-2024-36903)

    kernel:ipv6: prevent NULL dereference in ip6_output()(CVE-2024-36901)

    kernel:ipvlan: add ipvlan_route_v6_outbound() helper(CVE-2023-52796)

    kernel:irqchip/gic-v3-its: Prevent double free on error(CVE-2024-35847)

    kernel: md/dm-raid: don#39;t call md_reap_sync_thread() directly(CVE-2024-35808)

    kernel:net/mlx5: Properly link new fs rules into the tree(CVE-2024-35960)

    kernel:net/mlx5e: fix a double-free in arfs_create_groups(CVE-2024-35835)

    kernel:net: fix __dst_negative_advice() race(CVE-2024-36971)

    kernel:net: fix out-of-bounds access in ops_init(CVE-2024-36883)

    kernel:netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()(CVE-2024-27020)

    kernel:netfilter: validate user input for expected length(CVE-2024-35896)

    NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds(CVE-2021-46952)

    kernel:nvme-fc: do not wait in vain when unloading module(CVE-2024-26846)

    nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells(CVE-2021-47497)

    kernel: PCI/PM: Drain runtime-idle callbacks before driver removal(CVE-2024-35809)

    kernel: perf/core: Bail out early if the request AUX area is out of bound(CVE-2023-52835)

    kernel: pinctrl: core: delete incorrect free in pinctrl_enable()(CVE-2024-36940)

    kernel:dm: call the resume method on internal suspend(CVE-2024-26880)

    kernel:RDMA: Verify port when creating flow rule(CVE-2021-47265)

    kernel:ring-buffer: Fix a race between readers and resize checks(CVE-2024-38601)

    kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload(CVE-2024-36919)

    kernel:scsi: iscsi: Fix iscsi_task use after free(CVE-2021-47427)

    kernel:scsi: lpfc: Fix link down processing to address NULL pointer dereference(CVE-2021-47183)

    kernel:scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()(CVE-2024-36924)

    kernel: scsi: mpt3sas: Fix use-after-free warning(CVE-2022-48695)

    kernel: selinux: avoid dereference of garbage after mount failure(CVE-2024-35904)

    kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()(CVE-2023-52752)

    kernel:spi: Fix deadlock when adding SPI controllers on SPI buses(CVE-2021-47469)

    kernel:SUNRPC: fix a memleak in gss_import_v2_context(CVE-2023-52653)

    kernel:tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets(CVE-2024-36905)

    kernel:tcp: properly terminate timers for kernel sockets(CVE-2024-35910)

    kernel:tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().(CVE-2024-36904)

    kernel: thermal: core: prevent potential string overflow(CVE-2023-52868)

    tty: Fix out-of-bound vmalloc access in imageblit(CVE-2021-47383)

    kernel:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()(CVE-2024-36016)

    kernel:vt: fix unicode buffer corruption when deleting characters(CVE-2024-35823)

    kernel:llc: verify mac len before reading mac header(CVE-2023-52843)

    kernel:SUNRPC: fix some memleaks in gssx_dec_option_array(CVE-2024-27388)

    kernel:net: cdc_eem: fix tx fixup skb leak(CVE-2021-47236)

    NFS: Fix use-after-free in nfs4_init_client()(CVE-2021-47259)

    kernel: IB/mlx5: Fix initializing CQ fragments buffer(CVE-2021-47261)

    kernel:kvm: avoid speculation-based attacks from out-of-range memslot accesses(CVE-2021-47277)

    kernel: drm: Fix use-after-free read in drm_getunique()(CVE-2021-47280)

    net/sched: act_skbmod: Skip non-Ethernet packets(CVE-2021-47293)

    kernel:igb: Fix use-after-free error during reset(CVE-2021-47301)

    kernel:net: qcom/emac: fix UAF in emac_remove(CVE-2021-47311)

    kernel:scsi: megaraid_sas: Fix resource leak in case of probe failure(CVE-2021-47329)

    kernel: udf: Fix NULL pointer dereference in udf_symlink function(CVE-2021-47353)

    kernel: drm/sched: Avoid data corruptions(CVE-2021-47354)

    irqchip/gic-v3-its: Fix potential VPE leak on error(CVE-2021-47373)

    kernel:sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb(CVE-2021-47397)

    kernel: netfilter: conntrack: serialize hash resizes and cleanups(CVE-2021-47408)

    phy: mdio: fix memory leak(CVE-2021-47416)

    i40e: Fix freeing of uninitialized misc IRQ vector(CVE-2021-47424)

    kernel:i2c: acpi: fix resource leak in reconfiguration device addition(CVE-2021-47425)

    kernel: dm: fix mempool NULL pointer race when completing IO(CVE-2021-47435)

    kernel:net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path(CVE-2021-47438)

    kernel:ptp: Fix possible memory leak in ptp_clock_register()(CVE-2021-47455)

    kernel: mm, slub: fix potential memoryleak in kmem_cache_open()(CVE-2021-47466)

    kernel: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()(CVE-2021-47473)

    kernel: isofs: Fix out of bound access for corrupted isofs image(CVE-2021-47478)

    kernel: scsi: core: Put LLD module refcnt after SCSI device is released(CVE-2021-47480)

    kernel:regmap: Fix possible double-free in regcache_rbtree_exit()(CVE-2021-47483)

    kernel:usbnet: sanity check for maxpacket(CVE-2021-47495)

    kernel:i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc(CVE-2021-47501)

    kernel:nfp: Fix memory leak in nfp_cpp_area_cache_add()(CVE-2021-47516)

    serial: core: fix transmit-buffer reset and memleak(CVE-2021-47527)

    kernel:net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()(CVE-2021-47541)

    tcp: fix page frag corruption on page fault(CVE-2021-47544)

    kernel:ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in     hns_dsaf_ge_srst_by_port()(CVE-2021-47548)

    kernel: scsi: mpt3sas: Fix kernel panic during drive powercycle test(CVE-2021-47565)

    proc/vmcore: fix clearing user buffer by properly using clear_user()(CVE-2021-47566)

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()(CVE-2021-47576)

    ovl: fix warning in ovl_create_real()(CVE-2021-47579)

    sit: do not call ipip6_dev_free() from sit_init_net()(CVE-2021-47588)

    igbvf: fix double free in `igbvf_probe`(CVE-2021-47589)

    kernel:inet_diag: fix kernel-infoleak for UDP sockets(CVE-2021-47597)

    net: netlink: af_netlink: Prevent empty skb by adding a check on len.(CVE-2021-47606)

    kernel:firmware: arm_scpi: Fix string overflow in SCPI genpd driver(CVE-2021-47609)

    kernel:i40e: Fix queues reservation for XDP(CVE-2021-47619)

    kernel: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe(CVE-2022-48715)

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()(CVE-2022-48742)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    phylib: fix potential use-after-free(CVE-2022-48754)

    vsock: remove vsock from connected table when connect is interrupted by a signal(CVE-2022-48786)

    perf: Fix list corruption in perf_cgroup_switch()(CVE-2022-48799)

    kernel:vt_ioctl: fix array_index_nospec in vt_setactivate(CVE-2022-48804)

    net: fix a memleak when uncloning an skb dst and its metadata(CVE-2022-48809)

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path(CVE-2022-48810)

    kernel:sctp: fix kernel-infoleak for SCTP sockets(CVE-2022-48855)

    kernel:of: Fix double free in of_parse_phandle_with_args_map(CVE-2023-52679)

    kernel:net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path(CVE-2023-52703)

    kernel: mmc: mmc_spi: fix error handling in mmc_spi_probe()(CVE-2023-52708)

    kernel: Fix page corruption caused by racy check in __free_pages(CVE-2023-52739)

    kernel:SUNRPC: Fix RPC client cleaned up the freed pipefs dentries(CVE-2023-52803)

    kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET(CVE-2023-52813)

    kernel:tcp: do not accept ACK of bytes we never sent(CVE-2023-52881)

    kernel:nouveau: lock the client object tree. (CVE-2024-27062)

    kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes(CVE-2024-35789)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    kernel: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion(CVE-2024-35815)

    kernel: fbmon: prevent division by zero in fb_videomode_from_videomode()(CVE-2024-35922)

    kernel:scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()  (CVE-2024-35930)

    kernel:kprobes: Fix possible use-after-free issue on kprobe registration(CVE-2024-35955)

    kernel:netfilter: complete validation of user input(CVE-2024-35962)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up(CVE-2024-36952)

    kernel:virtio: delete vq in vp_find_vqs_msix() when request_irq() fails(CVE-2024-37353)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    kernel:of: module: add buffer overflow check in of_modalias()(CVE-2024-38541)

    kernel:scsi: qedf: Ensure the copied buf is NUL terminated(CVE-2024-38559)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel: ext4: fix mb_cache_entry#39;s e_refcnt leak in ext4_xattr_block_cache_find()CVE-2024-39276)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    kernel:USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages(CVE-2024-40904)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    kernel:ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.(CVE-2024-40984)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:ext4: fix uninitialized ratelimit_state-lock access in __ext4_fill_super()(CVE-2024-40998)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    kernel: cpu/hotplug: Don't offline the last non-isolated CPU(CVE-2023-52831)

    kernel: IB/mlx5: Fix initializing CQ fragments buffer(CVE-2021-47261)

    kernel: drm: Fix use-after-free read in drm_getunique()(CVE-2021-47280)

    kernel: selinux: avoid dereference of garbage after mount failure(CVE-2024-35904)

    kernel: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()(CVE-2021-47473)

    kernel: block: fix overflow in blk_ioctl_discard()(CVE-2024-36917)

    kernel: PCI/PM: Drain runtime-idle callbacks before driver removal(CVE-2024-35809)

    kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET(CVE-2023-52813)

    kernel: thermal: core: prevent potential string overflow(CVE-2023-52868)

    kernel: udf: Fix NULL pointer dereference in udf_symlink function(CVE-2021-47353)

    kernel: pinctrl: core: delete incorrect free in pinctrl_enable()(CVE-2024-36940)

    kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes(CVE-2024-35789)

    kernel: scsi: mpt3sas: Fix kernel panic during drive powercycle test(CVE-2021-47565)

    kernel: isofs: Fix out of bound access for corrupted isofs image(CVE-2021-47478)

    kernel: ext4: fix corruption during on-line resize(CVE-2024-35807)

    kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload(CVE-2024-36919)

    kernel: perf/core: Bail out early if the request AUX area is out of bound(CVE-2023-52835)

    kernel: md/dm-raid: don#39;t call md_reap_sync_thread() directly(CVE-2024-35808)

    kernel: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe(CVE-2022-48715)

    kernel: mm, slub: fix potential memoryleak in kmem_cache_open()(CVE-2021-47466)

    kernel: ext4: fix mb_cache_entry#39;s e_refcnt leak in ext4_xattr_block_cache_find()(CVE-2024-39276)

    kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up(CVE-2024-36952)

    kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()(CVE-2023-52752)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    kernel:block: prevent division by zero in blk_rq_stat_sum()(CVE-2024-35925)

    kernel:scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()  (CVE-2024-35930)

    kernel:scsi: qedf: Ensure the copied buf is NUL terminated(CVE-2024-38559)

    kernel:kvm: avoid speculation-based attacks from out-of-range memslot accesses(CVE-2021-47277)

    kernel:net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()(CVE-2021-47541)

    kernel:usbnet: sanity check for maxpacket(CVE-2021-47495)

    kernel:kprobes: Fix possible use-after-free issue on kprobe registration(CVE-2024-35955)

    kernel:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()(CVE-2024-36016)

    kernel:tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets(CVE-2024-36905)

    kernel:tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().(CVE-2024-36904)

    kernel:scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()(CVE-2024-36924)

    kernel:net/mlx5: Properly link new fs rules into the tree(CVE-2024-35960)

    kernel:net: fix __dst_negative_advice() race(CVE-2024-36971)

    kernel:regmap: Fix possible double-free in regcache_rbtree_exit()(CVE-2021-47483)

    kernel:block: Fix wrong offset in bio_truncate()(CVE-2022-48747)

    kernel:ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.(CVE-2024-40984)

    kernel:igb: Fix use-after-free error during reset(CVE-2021-47301)

    kernel:netfilter: complete validation of user input(CVE-2024-35962)

    kernel:llc: verify mac len before reading mac header(CVE-2023-52843)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:virtio: delete vq in vp_find_vqs_msix() when request_irq() fails(CVE-2024-37353)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    kernel:ring-buffer: Fix a race between readers and resize checks(CVE-2024-38601)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel:HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up(CVE-2024-35997)

    kernel:i2c: smbus: fix NULL function pointer dereference(CVE-2024-35984)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    kernel:inet_diag: fix kernel-infoleak for UDP sockets(CVE-2021-47597)

    kernel:nfp: Fix memory leak in nfp_cpp_area_cache_add()(CVE-2021-47516)

    kernel:erspan: make sure erspan_base_hdr is present in skb-head(CVE-2024-35888)

    kernel:netfilter: validate user input for expected length(CVE-2024-35896)

    kernel:net: cdc_eem: fix tx fixup skb leak(CVE-2021-47236)

    kernel:ipvlan: add ipvlan_route_v6_outbound() helper(CVE-2023-52796)

    kernel:RDMA: Verify port when creating flow rule(CVE-2021-47265)

    kernel:ipv6: Fix infinite recursion in fib6_dump_done().(CVE-2024-35886)

    kernel:i40e: Do not use WQ_MEM_RECLAIM flag for workqueue(CVE-2024-36004)

    kernel:net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path(CVE-2021-47438)

    kernel:net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path(CVE-2023-52703)

    kernel:net/mlx5e: fix a double-free in arfs_create_groups(CVE-2024-35835)

    kernel:i40e: Fix queues reservation for XDP(CVE-2021-47619)

    kernel:sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb(CVE-2021-47397)

    kernel:calipso: fix memory leak in netlbl_calipso_add_pass()(CVE-2023-52698)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc(CVE-2021-47501)

    kernel:i2c: acpi: fix resource leak in reconfiguration device addition(CVE-2021-47425)

    kernel:net: fix out-of-bounds access in ops_init(CVE-2024-36883)

    kernel:ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()(CVE-2024-36902)

    kernel:ipv6: prevent NULL dereference in ip6_output()(CVE-2024-36901)

    kernel:tcp: do not accept ACK of bytes we never sent(CVE-2023-52881)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:scsi: megaraid_sas: Fix resource leak in case of probe failure(CVE-2021-47329)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    kernel:ACPI: CPPC: Use access_width over bit_width for system memory accesses(CVE-2024-35995)

    kernel:ext4: fix uninitialized ratelimit_state-lock access in __ext4_fill_super()(CVE-2024-40998)

    kernel:vt_ioctl: fix array_index_nospec in vt_setactivate(CVE-2022-48804)

    kernel:sctp: fix kernel-infoleak for SCTP sockets(CVE-2022-48855)

    kernel:USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages(CVE-2024-40904)

    kernel:tcp: properly terminate timers for kernel sockets(CVE-2024-35910)

    kernel:SUNRPC: Fix RPC client cleaned up the freed pipefs dentries(CVE-2023-52803)

    kernel:scsi: iscsi: Fix iscsi_task use after free(CVE-2021-47427)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

    kernel:RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests(CVE-2021-47391)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero     bytes, and crash, because of a missing check for ubi-leb_size.(CVE-2024-25739)

    audit: fix possible null-pointer dereference in audit_filter_rules(CVE-2021-47464)

    gfs2: ignore negated quota changes(CVE-2023-52759)

    bpf: Add oversize check before call kvcalloc()(CVE-2021-47376)

    ACPI: video: check for error while searching for backlight device parent(CVE-2023-52693)

    media: bttv: fix use after free error due to btv-timeout timer(CVE-2023-52847)

    isdn: mISDN: Fix sleeping function called from invalid context(CVE-2021-47468)

    cifs: Fix use-after-free in rdata-read_into_pages()(CVE-2023-52741)

    virtio-blk: fix implicit overflow on virtio_max_dma_size(CVE-2023-52762)

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()(CVE-2023-52809)

    xhci: Fix command ring pointer corruption while aborting a command(CVE-2021-47434)

    tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc(CVE-2023-52880)

    ACPI: LPIT: Avoid u32 multiplication overflow(CVE-2023-52683)

    media: gspca: cpia1: shift-out-of-bounds in set_flicker(CVE-2023-52764)

    ALSA: pcm: oss: Fix negative period/buffer sizes(CVE-2021-47511)

    mlxsw: spectrum_acl_tcam: Fix memory leak during rehash(CVE-2024-35853)

    mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update(CVE-2024-35855)

    A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver, causing kernel panic and a denial of service.(CVE-2023-6536)

    drm/vmwgfx: Fix invalid reads in fence signaled events(CVE-2024-36960)

    x86/mm/pat: fix VM_PAT handling in COW mappings(CVE-2024-35877)

    HID: usbhid: free raw_report buffers in usbhid_stop(CVE-2021-47405)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)

    platform/x86: wmi: Fix opening of char device(CVE-2023-52864)

    isdn: mISDN: netjet: Fix crash in nj_probe(CVE-2021-47284)

    ovl: fix warning in ovl_create_real()(CVE-2021-47579)

    genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline(CVE-2024-31076)

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()(CVE-2021-47576)

    scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()(CVE-2022-48758)

    media: lgdt3306a: Add a check against null-pointer-def(CVE-2022-48772)

    USB: core: Fix hang in usb_kill_urb by adding memory barriers(CVE-2022-48760)

    media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()(CVE-2021-47288)

    tcp: fix page frag corruption on page fault(CVE-2021-47544)

    mac80211: track only QoS data frames for admission control(CVE-2021-47602)

    tipc: fix UAF in error path(CVE-2024-36886)

    wifi: mac80211: don't return unset power in ieee80211_get_tx_power()(CVE-2023-52832)

    can: peak_pci: peak_pci_remove(): fix UAF(CVE-2021-47456)

    sched/psi: Fix use-after-free in ep_remove_wait_queue()(CVE-2023-52707)

    In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to     drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.(CVE-2024-23848)

    KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio(CVE-2021-47341)

    drm/amd/display: Avoid NULL dereference of timing generator(CVE-2023-52753)

    wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach(CVE-2024-35811)

    The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in     the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local     access, this 'could be exploited in a real world scenario.' This is related to     brcmf_cfg80211_escan_timeout_worker in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.(CVE-2023-47233)

    vmci: prevent speculation leaks by sanitizing event in event_deliver()(CVE-2024-39499)

    drm/amd/display: Fix potential index out of bounds in color transformation function(CVE-2024-38552)

    netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()(CVE-2024-36286)

    ppdev: Add an error check in register_device(CVE-2024-36015)

    atl1c: Work around the DMA RX overflow issue(CVE-2023-52834)

    igc: Fix use-after-free error during reset(CVE-2021-47302)

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation(CVE-2024-36017)

    wifi: nl80211: don't free NULL coalescing rule(CVE-2024-36941)

    nsh: Restore skb-{protocol,data,mac_header} for outer header in nsh_gso_segment().(CVE-2024-36933)

    drm/amd/display: Skip on writeback when it's not applicable(CVE-2024-36914)

    amd/amdkfd: sync all devices to wait all processes being evicted(CVE-2024-36949)

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue(CVE-2024-36938)

    tipc: fix a possible memleak in tipc_buf_append(CVE-2024-36954)

    nvme: fix a possible use-after-free in controller reset during load(CVE-2022-48790)

    nvme-tcp: fix possible use-after-free in transport error_recovery work(CVE-2022-48789)

    drivers: core: synchronize really_probe() and dev_uevent()(CVE-2024-39501)

    net: openvswitch: fix overwriting ct original tuple for ICMPv6(CVE-2024-38558)

    drm/vrr: Set VRR capable prop only if it is attached to connector(CVE-2022-48843)

    Input: aiptek - properly check endpoint type(CVE-2022-48836)

    scsi: qedf: Fix refcount issue when LOGO is received during TMF(CVE-2022-48823)

    media: mxl111sf: change mutex_init() location(CVE-2021-47583)

    net-sysfs: add check for netdevice being present to speed_show(CVE-2022-48850)

    A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function.
    This can result in a bluetooth sniffing exception issue, possibly leading denial of     service.(CVE-2024-24859)

    A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set()     function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial     of service.(CVE-2024-24858)

    A race condition was found in the Linux kernel's net/bluetooth device driver in     conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to     bluetooth connection abnormality or denial of service.(CVE-2024-24857)

    mmc: sdio: fix possible resource leaks in some error paths(CVE-2023-52730)

    scsi: libfc: Fix array index out of bound exception(CVE-2021-47308)

    IB/hfi1: Restore allocated resources on failed copyout(CVE-2023-52747)

    firewire: ohci: mask bus reset interrupts between ISR and bottom half(CVE-2024-36950)

    Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj(CVE-2022-48775)

    media: imon: fix access to invalid resource for the second interface(CVE-2023-52754)

    ipvlan: Dont Use skb-sk in ipvlan_process_v{4,6}_outbound(CVE-2024-33621)

    ipv6: fix potential 'struct net' leak in inet6_rtm_getaddr()(CVE-2024-27417)

    scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory(CVE-2024-40901)

    NFSD: Fix ia_size underflow(CVE-2022-48828)

    net: amd-xgbe: Fix skb data length underflow(CVE-2022-48743)

    drm     ouveau: fix off by one in BIOS boundary checking(CVE-2022-48732)

    net: fix information leakage in /proc/net/ptype(CVE-2022-48757)

    dma-buf/sync_file: Don't leak fences on merge failure(CVE-2021-47305)

    nvme-rdma: fix possible use-after-free in transport error_recovery work(CVE-2022-48788)

    crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak(CVE-2024-39493)

    scsi: qedi: Fix crash while reading debugfs attribute(CVE-2024-40978)

    ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup(CVE-2021-47399)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    bpf, sockmap: Prevent lock inversion deadlock in map delete elem(CVE-2024-35895)

    netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()(CVE-2024-35898)

    mac80211: limit injected vht mcs     ss in ieee80211_parse_tx_radiotap(CVE-2021-47395)

    mlxsw: spectrum_acl_tcam: Fix incorrect list API usage(CVE-2024-36006)

    kvm: LAPIC: Restore guard to prevent illegal APIC register access(CVE-2021-47255)

    tipc: fix kernel panic when enabling bearer(CVE-2022-48865)

    tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING(CVE-2023-52845)

    xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING(CVE-2024-35976)

    mlxsw: spectrum_acl_tcam: Fix warning during rehash(CVE-2024-36007)

    net: bridge: fix vlan tunnel dst null pointer dereference(CVE-2021-47223)

    net/sched: act_skbmod: Skip non-Ethernet packets(CVE-2021-47293)

    net: bridge: fix vlan tunnel dst refcnt when egressing(CVE-2021-47222)

    asix: fix uninit-value in asix_mdio_read()(CVE-2021-47101)

    A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in     drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a     denial of service.(CVE-2023-7042)

    A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000     xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to     malfunction or denial of service issue.(CVE-2024-24861)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    kernel: scsi: core: Put LLD module refcnt after SCSI device is released(CVE-2021-47480)

    kernel: dm rq: don't queue request to blk-mq during DM suspend(CVE-2021-47498)

    kernel: dm: fix mempool NULL pointer race when completing IO(CVE-2021-47435)

    kernel: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion(CVE-2024-35815)

    kernel: io_uring: drop any code related to SCM_RIGHTS(CVE-2023-52656)

    kernel: cpu/hotplug: Don't offline the last non-isolated CPU(CVE-2023-52831)

    kernel: drm/sched: Avoid data corruptions(CVE-2021-47354)

    kernel: IB/mlx5: Fix initializing CQ fragments buffer(CVE-2021-47261)

    kernel: drm: Fix use-after-free read in drm_getunique()(CVE-2021-47280)

    kernel: selinux: avoid dereference of garbage after mount failure(CVE-2024-35904)

    kernel: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()(CVE-2021-47473)

    kernel: mmc: mmc_spi: fix error handling in mmc_spi_probe()(CVE-2023-52708)

    kernel: block: fix overflow in blk_ioctl_discard()(CVE-2024-36917)

    kernel: PCI/PM: Drain runtime-idle callbacks before driver removal(CVE-2024-35809)

    kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET(CVE-2023-52813)

    kernel: bcache: avoid oversized read request in cache missing code path(CVE-2021-47275)

    kernel: thermal: core: prevent potential string overflow(CVE-2023-52868)

    kernel: udf: Fix NULL pointer dereference in udf_symlink function(CVE-2021-47353)

    kernel: pinctrl: core: delete incorrect free in pinctrl_enable()(CVE-2024-36940)

    kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes(CVE-2024-35789)

    kernel: netfilter: conntrack: serialize hash resizes and cleanups(CVE-2021-47408)

    kernel: scsi: mpt3sas: Fix kernel panic during drive powercycle test(CVE-2021-47565)

    kernel: fbmon: prevent division by zero in fb_videomode_from_videomode()(CVE-2024-35922)

    kernel: isofs: Fix out of bound access for corrupted isofs image(CVE-2021-47478)

    kernel: ext4: fix corruption during on-line resize(CVE-2024-35807)

    kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload(CVE-2024-36919)

    kernel: perf/core: Bail out early if the request AUX area is out of bound(CVE-2023-52835)

    kernel: md/dm-raid: don#39;t call md_reap_sync_thread() directly(CVE-2024-35808)

    kernel: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe(CVE-2022-48715)

    kernel: Fix page corruption caused by racy check in __free_pages(CVE-2023-52739)

    kernel: mm, slub: fix potential memoryleak in kmem_cache_open()(CVE-2021-47466)

    kernel: ext4: fix mb_cache_entry#39;s e_refcnt leak in ext4_xattr_block_cache_find()(CVE-2024-39276)

    kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up(CVE-2024-36952)

    kernel: scsi: mpt3sas: Fix use-after-free warning(CVE-2022-48695)

    kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()(CVE-2023-52752)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    kernel:block: prevent division by zero in blk_rq_stat_sum()(CVE-2024-35925)

    kernel:nouveau: lock the client object tree. (CVE-2024-27062)

    kernel:scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()  (CVE-2024-35930)

    kernel:scsi: qedf: Ensure the copied buf is NUL terminated(CVE-2024-38559)

    kernel:kvm: avoid speculation-based attacks from out-of-range memslot accesses(CVE-2021-47277)

    kernel:net: qcom/emac: fix UAF in emac_remove(CVE-2021-47311)

    kernel:net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()(CVE-2021-47541)

    kernel:ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in     hns_dsaf_ge_srst_by_port()(CVE-2021-47548)

    kernel:usbnet: sanity check for maxpacket(CVE-2021-47495)

    kernel:kprobes: Fix possible use-after-free issue on kprobe registration(CVE-2024-35955)

    kernel:netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()(CVE-2024-27020)

    kernel:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()(CVE-2024-36016)

    kernel:tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets(CVE-2024-36905)

    kernel:tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().(CVE-2024-36904)

    kernel:scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()(CVE-2024-36924)

    kernel:net/mlx5: Properly link new fs rules into the tree(CVE-2024-35960)

    kernel:net: fix __dst_negative_advice() race(CVE-2024-36971)

    kernel:regmap: Fix possible double-free in regcache_rbtree_exit()(CVE-2021-47483)

    kernel:block: Fix wrong offset in bio_truncate()(CVE-2022-48747)

    kernel:of: module: add buffer overflow check in of_modalias()(CVE-2024-38541)

    kernel:ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.(CVE-2024-40984)

    kernel:igb: Fix use-after-free error during reset(CVE-2021-47301)

    kernel:firmware: arm_scpi: Fix string overflow in SCPI genpd driver(CVE-2021-47609)

    kernel:netfilter: complete validation of user input(CVE-2024-35962)

    kernel:llc: verify mac len before reading mac header(CVE-2023-52843)

    kernel:SUNRPC: fix a memleak in gss_import_v2_context(CVE-2023-52653)

    kernel:SUNRPC: fix some memleaks in gssx_dec_option_array(CVE-2024-27388)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:of: Fix double free in of_parse_phandle_with_args_map(CVE-2023-52679)

    kernel:scsi: lpfc: Fix link down processing to address NULL pointer dereference(CVE-2021-47183)

    kernel:nvme-fc: do not wait in vain when unloading module(CVE-2024-26846)

    kernel:dm: call the resume method on internal suspend(CVE-2024-26880)

    kernel:virtio: delete vq in vp_find_vqs_msix() when request_irq() fails(CVE-2024-37353)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    kernel:ring-buffer: Fix a race between readers and resize checks(CVE-2024-38601)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel:HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up(CVE-2024-35997)

    kernel:i2c: smbus: fix NULL function pointer dereference(CVE-2024-35984)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    kernel:inet_diag: fix kernel-infoleak for UDP sockets(CVE-2021-47597)

    kernel:nfp: Fix memory leak in nfp_cpp_area_cache_add()(CVE-2021-47516)

    kernel:erspan: make sure erspan_base_hdr is present in skb-head(CVE-2024-35888)

    kernel:netfilter: validate user input for expected length(CVE-2024-35896)

    kernel:ipv6: Fix potential uninit-value access in __ip6_make_skb()(CVE-2024-36903)

    kernel:net: cdc_eem: fix tx fixup skb leak(CVE-2021-47236)

    kernel:ipvlan: add ipvlan_route_v6_outbound() helper(CVE-2023-52796)

    kernel:RDMA: Verify port when creating flow rule(CVE-2021-47265)

    kernel:ipv6: Fix infinite recursion in fib6_dump_done().(CVE-2024-35886)

    kernel:i40e: Do not use WQ_MEM_RECLAIM flag for workqueue(CVE-2024-36004)

    kernel:net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path(CVE-2021-47438)

    kernel:net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path(CVE-2023-52703)

    kernel:net/mlx5e: fix a double-free in arfs_create_groups(CVE-2024-35835)

    kernel:i40e: Fix queues reservation for XDP(CVE-2021-47619)

    kernel:pinctrl: single: fix potential NULL dereference(CVE-2022-48708)

    kernel:vt: fix unicode buffer corruption when deleting characters(CVE-2024-35823)

    kernel:ptp: Fix possible memory leak in ptp_clock_register()(CVE-2021-47455)

    kernel:sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb(CVE-2021-47397)

    kernel:calipso: fix memory leak in netlbl_calipso_add_pass()(CVE-2023-52698)

    kernel:irqchip/gic-v3-its: Prevent double free on error(CVE-2024-35847)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:spi: Fix deadlock when adding SPI controllers on SPI buses(CVE-2021-47469)

    kernel:i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc(CVE-2021-47501)

    kernel:i2c: acpi: fix resource leak in reconfiguration device addition(CVE-2021-47425)

    kernel:net: fix out-of-bounds access in ops_init(CVE-2024-36883)

    kernel:ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()(CVE-2024-36902)

    kernel:ipv6: prevent NULL dereference in ip6_output()(CVE-2024-36901)

    kernel:tcp: do not accept ACK of bytes we never sent(CVE-2023-52881)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:scsi: megaraid_sas: Fix resource leak in case of probe failure(CVE-2021-47329)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    kernel:ACPI: CPPC: Use access_width over bit_width for system memory accesses(CVE-2024-35995)

    kernel:ext4: fix uninitialized ratelimit_state-lock access in __ext4_fill_super()(CVE-2024-40998)

    kernel:vt_ioctl: fix array_index_nospec in vt_setactivate(CVE-2022-48804)

    kernel:sctp: fix kernel-infoleak for SCTP sockets(CVE-2022-48855)

    kernel:USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages(CVE-2024-40904)

    kernel:tcp: properly terminate timers for kernel sockets(CVE-2024-35910)

    kernel:SUNRPC: Fix RPC client cleaned up the freed pipefs dentries(CVE-2023-52803)

    kernel:scsi: iscsi: Fix iscsi_task use after free(CVE-2021-47427)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

    kernel:RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests(CVE-2021-47391)

    kernel:SUNRPC: Fix a suspicious RCU usage warning(CVE-2023-52623)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero     bytes, and crash, because of a missing check for ubi-leb_size.(CVE-2024-25739)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    kernel:ACPI: CPPC: Use access_width over bit_width for system memory accesses(CVE-2024-35995)

    ACPI: LPIT: Avoid u32 multiplication overflow(CVE-2023-52683)

    ACPI: video: check for error while searching for backlight device parent(CVE-2023-52693)

    bpf: Fix stackmap overflow check on 32-bit arches(CVE-2024-36949)

    kernel: block: fix overflow in blk_ioctl_discard()(CVE-2024-36917)

    kernel:block: prevent division by zero in blk_rq_stat_sum()(CVE-2024-35925)

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue(CVE-2024-36938)

    bpf, sockmap: Prevent lock inversion deadlock in map delete elem(CVE-2024-35895)

    kernel:calipso: fix memory leak in netlbl_calipso_add_pass()(CVE-2023-52698)

    drm/amd/display: Avoid NULL dereference of timing generator(CVE-2023-52753)

    drm/amd/display: Skip on writeback when it's not applicable(CVE-2024-36914)

    kernel:erspan: make sure erspan_base_hdr is present in skb-head(CVE-2024-35888)

    kernel: ext4: fix corruption during on-line resize(CVE-2024-35807)

    kernel: ext4: fix possible UAF when remounting r/o a mmp-protected file system(CVE-2021-47342)

    firewire: ohci: mask bus reset interrupts between ISR and bottom half(CVE-2024-36950)

    gfs2: ignore negated quota changes(CVE-2023-52759)

    kernel:HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up(CVE-2024-35997)

    kernel:i2c: smbus: fix NULL function pointer dereference(CVE-2024-35984)

    kernel:i40e: Do not use WQ_MEM_RECLAIM flag for workqueue(CVE-2024-36004)

    kernel:ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()(CVE-2024-36902)

    kernel:ipv6: Fix infinite recursion in fib6_dump_done().(CVE-2024-35886)

    kernel:ipv6: prevent NULL dereference in ip6_output()(CVE-2024-36901)

    kernel:ipvlan: add ipvlan_route_v6_outbound() helper(CVE-2023-52796)

    kernel: md/dm-raid: don#39;t call md_reap_sync_thread() directly(CVE-2024-35808)

    media: bttv: fix use after free error due to btv-timeout timer(CVE-2023-52847)

    media: gspca: cpia1: shift-out-of-bounds in set_flicker(CVE-2023-52764)

    mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update(CVE-2024-35855)

    mlxsw: spectrum_acl_tcam: Fix warning during rehash(CVE-2024-36007)

    kernel:net/mlx5: Properly link new fs rules into the tree(CVE-2024-35960)

    kernel:net/mlx5e: fix a double-free in arfs_create_groups(CVE-2024-35835)

    kernel:net: fix __dst_negative_advice() race(CVE-2024-36971)

    kernel:net: fix out-of-bounds access in ops_init(CVE-2024-36883)

    kernel:netfilter: validate user input for expected length(CVE-2024-35896)

    NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds(CVE-2021-46952)

    nsh: Restore skb-{protocol,data,mac_header} for outer header in nsh_gso_segment().(CVE-2024-36933)

    nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells(CVE-2021-47497)

    kernel: PCI/PM: Drain runtime-idle callbacks before driver removal(CVE-2024-35809)

    kernel: pinctrl: core: delete incorrect free in pinctrl_enable()(CVE-2024-36940)

    platform/x86: wmi: Fix opening of char device(CVE-2023-52864)

    ppdev: Add an error check in register_device(CVE-2024-36015)

    kernel:RDMA: Verify port when creating flow rule(CVE-2021-47265)

    kernel:ring-buffer: Fix a race between readers and resize checks(CVE-2024-38601)

    kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload(CVE-2024-36919)

    kernel:scsi: iscsi: Fix iscsi_task use after free(CVE-2021-47427)

    kernel:scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()(CVE-2024-36924)

    kernel: selinux: avoid dereference of garbage after mount failure(CVE-2024-35904)

    kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()(CVE-2023-52752)

    kernel:tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets(CVE-2024-36905)

    kernel:tcp: properly terminate timers for kernel sockets(CVE-2024-35910)

    kernel:tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().(CVE-2024-36904)

    kernel: thermal: core: prevent potential string overflow(CVE-2023-52868)

    tipc: fix a possible memleak in tipc_buf_append(CVE-2024-36954)

    tipc: fix UAF in error path(CVE-2024-36886)

    kernel:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()(CVE-2024-36016)

    virtio-blk: fix implicit overflow on virtio_max_dma_size(CVE-2023-52762)

    wifi: mac80211: don't return unset power in ieee80211_get_tx_power()(CVE-2023-52832)

    kernel:llc: verify mac len before reading mac header(CVE-2023-52843)

    x86/mm/pat: fix VM_PAT handling in COW mappings(CVE-2024-35877)

    drm/client: Fully protect modes[] with dev-mode_config.mutex(CVE-2024-35950)

    mlxsw: spectrum_acl_tcam: Fix incorrect list API usage(CVE-2024-36006)

    net: bridge: fix vlan tunnel dst refcnt when egressing(CVE-2021-47222)

    net: bridge: fix vlan tunnel dst null pointer dereference(CVE-2021-47223)

    KVM: x86: Immediately reset the MMU context when the SMM flag is cleared(CVE-2021-47230)

    kernel:net: cdc_eem: fix tx fixup skb leak(CVE-2021-47236)

    net: ipv4: fix memory leak in ip_mc_add1_src(CVE-2021-47238)

    netfilter: synproxy: Fix out of bounds when parsing TCP options(CVE-2021-47245)

    udp: fix race between close() and udp_abort()(CVE-2021-47248)

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std(CVE-2021-47250)

    kvm: LAPIC: Restore guard to prevent illegal APIC register access(CVE-2021-47255)

    NFS: Fix use-after-free in nfs4_init_client()(CVE-2021-47259)

    kernel: IB/mlx5: Fix initializing CQ fragments buffer(CVE-2021-47261)

    ftrace: Do not blindly read the ip address in ftrace_bug()(CVE-2021-47276)

    kernel:kvm: avoid speculation-based attacks from out-of-range memslot accesses(CVE-2021-47277)

    kernel: drm: Fix use-after-free read in drm_getunique()(CVE-2021-47280)

    isdn: mISDN: netjet: Fix crash in nj_probe(CVE-2021-47284)

    media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()(CVE-2021-47288)

    net/sched: act_skbmod: Skip non-Ethernet packets(CVE-2021-47293)

    kernel:igb: Fix use-after-free error during reset(CVE-2021-47301)

    igc: Fix use-after-free error during reset(CVE-2021-47302)

    scsi: libfc: Fix array index out of bound exception(CVE-2021-47308)

    virtio-blk: Fix memory leak among suspend/resume procedure(CVE-2021-47319)

    scsi: iscsi: Fix conn use after free during resets(CVE-2021-47328)

    kernel:scsi: megaraid_sas: Fix resource leak in case of probe failure(CVE-2021-47329)

    KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio(CVE-2021-47341)

    kernel: udf: Fix NULL pointer dereference in udf_symlink function(CVE-2021-47353)

    bpf: Add oversize check before call kvcalloc()(CVE-2021-47376)

    mac80211: limit injected vht mcs     ss in ieee80211_parse_tx_radiotap(CVE-2021-47395)

    kernel:sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb(CVE-2021-47397)

    ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup(CVE-2021-47399)

    HID: usbhid: free raw_report buffers in usbhid_stop(CVE-2021-47405)

    KVM: x86: Handle SRCU initialization failure during page track init(CVE-2021-47407)

    phy: mdio: fix memory leak(CVE-2021-47416)

    net_sched: fix NULL deref in fifo_set_limit()(CVE-2021-47418)

    i40e: Fix freeing of uninitialized misc IRQ vector(CVE-2021-47424)

    kernel:i2c: acpi: fix resource leak in reconfiguration device addition(CVE-2021-47425)

    xhci: Fix command ring pointer corruption while aborting a command(CVE-2021-47434)

    kernel:net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path(CVE-2021-47438)

    can: peak_pci: peak_pci_remove(): fix UAF(CVE-2021-47456)

    audit: fix possible null-pointer dereference in audit_filter_rules(CVE-2021-47464)

    kernel: mm, slub: fix potential memoryleak in kmem_cache_open()(CVE-2021-47466)

    isdn: mISDN: Fix sleeping function called from invalid context(CVE-2021-47468)

    kernel: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()(CVE-2021-47473)

    kernel: isofs: Fix out of bound access for corrupted isofs image(CVE-2021-47478)

    kernel:regmap: Fix possible double-free in regcache_rbtree_exit()(CVE-2021-47483)

    kernel:usbnet: sanity check for maxpacket(CVE-2021-47495)

    net/tls: Fix flipped sign in tls_err_abort() calls(CVE-2021-47496)

    kernel:i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc(CVE-2021-47501)

    ALSA: pcm: oss: Fix negative period/buffer sizes(CVE-2021-47511)

    kernel:nfp: Fix memory leak in nfp_cpp_area_cache_add()(CVE-2021-47516)

    serial: core: fix transmit-buffer reset and memleak(CVE-2021-47527)

    kernel:net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()(CVE-2021-47541)

    tcp: fix page frag corruption on page fault(CVE-2021-47544)

    kernel: scsi: mpt3sas: Fix kernel panic during drive powercycle test(CVE-2021-47565)

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()(CVE-2021-47576)

    ovl: fix warning in ovl_create_real()(CVE-2021-47579)

    media: mxl111sf: change mutex_init() location(CVE-2021-47583)

    sit: do not call ipip6_dev_free() from sit_init_net()(CVE-2021-47588)

    igbvf: fix double free in `igbvf_probe`(CVE-2021-47589)

    kernel:inet_diag: fix kernel-infoleak for UDP sockets(CVE-2021-47597)

    mac80211: track only QoS data frames for admission control(CVE-2021-47602)

    net: netlink: af_netlink: Prevent empty skb by adding a check on len.(CVE-2021-47606)

    PCI: pciehp: Fix infinite loop in IRQ handler upon power fault(CVE-2021-47617)

    kernel:i40e: Fix queues reservation for XDP(CVE-2021-47619)

    kernel: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe(CVE-2022-48715)

    drm     ouveau: fix off by one in BIOS boundary checking(CVE-2022-48732)

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()(CVE-2022-48742)

    net: amd-xgbe: Fix skb data length underflow(CVE-2022-48743)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    kernel:block: Fix wrong offset in bio_truncate()(CVE-2022-48747)

    phylib: fix potential use-after-free(CVE-2022-48754)

    net: fix information leakage in /proc/net/ptype(CVE-2022-48757)

    scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()(CVE-2022-48758)

    USB: core: Fix hang in usb_kill_urb by adding memory barriers(CVE-2022-48760)

    media: lgdt3306a: Add a check against null-pointer-def(CVE-2022-48772)

    Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj(CVE-2022-48775)

    vsock: remove vsock from connected table when connect is interrupted by a signal(CVE-2022-48786)

    nvme-rdma: fix possible use-after-free in transport error_recovery work(CVE-2022-48788)

    nvme-tcp: fix possible use-after-free in transport error_recovery work(CVE-2022-48789)

    nvme: fix a possible use-after-free in controller reset during load(CVE-2022-48790)

    kernel:vt_ioctl: fix array_index_nospec in vt_setactivate(CVE-2022-48804)

    net: fix a memleak when uncloning an skb dst and its metadata(CVE-2022-48809)

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path(CVE-2022-48810)

    scsi: qedf: Fix refcount issue when LOGO is received during TMF(CVE-2022-48823)

    NFSD: Fix ia_size underflow(CVE-2022-48828)

    Input: aiptek - properly check endpoint type(CVE-2022-48836)

    net/packet: fix slab-out-of-bounds access in packet_recvmsg()(CVE-2022-48839)

    drm/vrr: Set VRR capable prop only if it is attached to connector(CVE-2022-48843)

    net-sysfs: add check for netdevice being present to speed_show(CVE-2022-48850)

    kernel:sctp: fix kernel-infoleak for SCTP sockets(CVE-2022-48855)

    tipc: fix kernel panic when enabling bearer(CVE-2022-48865)

    The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in     the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local     access, this 'could be exploited in a real world scenario.' This is related to     brcmf_cfg80211_escan_timeout_worker in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.(CVE-2023-47233)

    kernel:net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path(CVE-2023-52703)

    sched/psi: Fix use-after-free in ep_remove_wait_queue()(CVE-2023-52707)

    mmc: sdio: fix possible resource leaks in some error paths(CVE-2023-52730)

    cifs: Fix use-after-free in rdata-read_into_pages()(CVE-2023-52741)

    IB/hfi1: Restore allocated resources on failed copyout(CVE-2023-52747)

    media: imon: fix access to invalid resource for the second interface(CVE-2023-52754)

    kernel:SUNRPC: Fix RPC client cleaned up the freed pipefs dentries(CVE-2023-52803)

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()(CVE-2023-52809)

    kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET(CVE-2023-52813)

    atl1c: Work around the DMA RX overflow issue(CVE-2023-52834)

    tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING(CVE-2023-52845)

    tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc(CVE-2023-52880)

    kernel:tcp: do not accept ACK of bytes we never sent(CVE-2023-52881)

    A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver, causing kernel panic and a denial of service.(CVE-2023-6536)

    In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to     drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.(CVE-2024-23848)

    A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function.
    This can result in a bluetooth sniffing exception issue, possibly leading denial of     service.(CVE-2024-24859)

    ipv6: fix potential 'struct net' leak in inet6_rtm_getaddr()(CVE-2024-27417)

    genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline(CVE-2024-31076)

    ipvlan: Dont Use skb-sk in ipvlan_process_v{4,6}_outbound(CVE-2024-33621)

    kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes(CVE-2024-35789)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach(CVE-2024-35811)

    mlxsw: spectrum_acl_tcam: Fix memory leak during rehash(CVE-2024-35853)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()(CVE-2024-35898)

    kernel:scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()  (CVE-2024-35930)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)

    kernel:netfilter: complete validation of user input(CVE-2024-35962)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING(CVE-2024-35976)

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation(CVE-2024-36017)

    netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()(CVE-2024-36286)

    wifi: nl80211: don't free NULL coalescing rule(CVE-2024-36941)

    kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up(CVE-2024-36952)

    drm/vmwgfx: Fix invalid reads in fence signaled events(CVE-2024-36960)

    kernel:virtio: delete vq in vp_find_vqs_msix() when request_irq() fails(CVE-2024-37353)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    drm/amd/display: Fix potential index out of bounds in color transformation function(CVE-2024-38552)

    net: openvswitch: fix overwriting ct original tuple for ICMPv6(CVE-2024-38558)

    kernel:scsi: qedf: Ensure the copied buf is NUL terminated(CVE-2024-38559)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel: ext4: fix mb_cache_entry#39;s e_refcnt leak in ext4_xattr_block_cache_find()(CVE-2024-39276)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak(CVE-2024-39493)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    vmci: prevent speculation leaks by sanitizing event in event_deliver()(CVE-2024-39499)

    drivers: core: synchronize really_probe() and dev_uevent()(CVE-2024-39501)

    scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory(CVE-2024-40901)

    kernel:USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages(CVE-2024-40904)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    scsi: qedi: Fix crash while reading debugfs attribute(CVE-2024-40978)

    kernel:ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.(CVE-2024-40984)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:ext4: fix uninitialized ratelimit_state-lock access in __ext4_fill_super()(CVE-2024-40998)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2896-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
    - CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
    - CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
    - CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
    - CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
    - CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
    - CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()     (bsc#1227866).
    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
    - CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
    - CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
    - CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
    - CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
    - CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
    - CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
    - CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
    - CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
    - CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
    - CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
    - CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
    - CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
    - CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
    - CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
    - CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
    - CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
    - CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()     (bsc#1227779).
    - CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
    - CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
    - CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
    - CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
    - CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
    - CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
    - CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
    - CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
    - CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
    - CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
    - CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
    - CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
    - CVE-2024-35890: gro: fix ownership transfer (bsc#1224516).
    - CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (bsc#1225719).
    - CVE-2024-36946: phonet: fix rtm_phonet_notify() skb allocation (bsc#1225851).
    - CVE-2024-38586: r8169: Fix possible ring buffer corruption on fragmented Tx packets (bsc#1226750).
    - CVE-2024-39468: smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103.
    - CVE-2024-40906: net/mlx5: Always stop health timer during driver removal (bsc#1227763).
    - CVE-2024-27012: netfilter: nf_tables: restore set elements when delete set fails (bsc#1223804).
    - CVE-2024-39498: drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 (bsc#1227723)
    - CVE-2024-39502: ionic: fix use after netif_napi_del() (bsc#1227755).
    - CVE-2024-27016: netfilter: flowtable: validate pppoe header (bsc#1223807).
    - CVE-2024-36901: ipv6: prevent NULL dereference in ip6_output() (bsc#1225711)
    - CVE-2024-36004: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1224545)
    - CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
    - CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (bsc#1224604).
    - CVE-2024-35854: Fixed possible use-after-free during rehash (bsc#1224636).
    - CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
    - CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
    - CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
    - CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
    - CVE-2024-27064: netfilter: nf_tables: Fix a memory leak in nf_tables_updchain (bsc#1223740).
    - CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
    - CVE-2023-47210: wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1225601, bsc#1225600).
    - CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
    - CVE-2024-38558: net: openvswitch: fix overwriting ct original tuple for ICMPv6 (bsc#1226783).
    - CVE-2024-39490: ipv6: sr: fix missing sk_buff release in seg6_input_core (bsc#1227626).
    - CVE-2024-26826: mptcp: fix data re-injection from stale subflow (bsc#1223010).
    - CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
    - CVE-2024-35942: pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain (bsc#1224589).
    - CVE-2024-26691: KVM: arm64: Fix circular locking dependency (bsc#1222463).
    - CVE-2024-36909: Drivers: hv: vmbus: Do not free ring buffers that couldn't be re-encrypted     (bsc#1225744).
    - CVE-2024-36910: uio_hv_generic: Do not free decrypted memory (bsc#1225717).
    - CVE-2024-36911: hv_netvsc: Do not free decrypted memory (bsc#1225745).
    - CVE-2024-36912: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752).
    - CVE-2024-36913: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753).
    - CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
    - CVE-2024-38659: enic: Validate length of nl attributes in enic_set_vf_port (bsc#1226883).
    - CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
    - CVE-2024-39482: bcache: fix variable length array abuse in btree_iter (bsc#1227447).
    - CVE-2024-39474: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL (bsc#1227434).
    - CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
    - CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
    - CVE-2024-38598: md: fix resync softlockup when bitmap size is less than array size (bsc#1226757).
    - CVE-2024-36003: ice: fix LAG and VF lock dependency in ice_reset_vf() (bsc#1224544).
    - CVE-2024-38604: block: refine the EOF check in blkdev_iomap_begin (bsc#1226866).
    - CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
    - CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
    - CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
    - CVE-2024-26623: pds_core: Prevent race issues involving the adminq (bsc#1221057).
    - CVE-2024-26785: iommufd: Fix protection fault in iommufd_test_syz_conv_iova (bsc#1222779).
    - CVE-2024-26734: devlink: fix possible use-after-free and memory leaks in devlink_init() (bsc#1222438).
    - CVE-2024-35805: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743).
    - CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
    - CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
    - CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
    - CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
    - CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
    - CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
    - CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
    - CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
    - CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
    - CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
    - CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
    - CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
    - CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
    - CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
    - CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
    - CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules     (bsc#1226799).
    - CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
    - CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'     (bsc#1226841).
    - CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
    - CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
    - CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE     (bsc#1226789).
    - CVE-2024-38566: bpf: Fix verifier assumptions about socket->sk (bsc#1226790).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
    - CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
    - CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
    - CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
    - CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
    - CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
    - CVE-2024-38556: net/mlx5: Add a timeout to acquire the command queue semaphore (bsc#1226774).
    - CVE-2024-38557: net/mlx5: Reload only IB representors upon lag disable/enable (bsc#1226781).
    - CVE-2024-38608: net/mlx5e: Fix netif state handling (bsc#1226746).
    - CVE-2024-38597: eth: sungem: remove .ndo_poll_controller to avoid deadlocks (bsc#1226749).
    - CVE-2024-38594: net: stmmac: move the EST lock to struct stmmac_priv (bsc#1226734).
    - CVE-2024-38569: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group (bsc#1226772).
    - CVE-2024-38568: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group (bsc#1226771).
    - CVE-2024-26814: vfio/fsl-mc: Block calling interrupt handler without trigger (bsc#1222810).
    - CVE-2024-26813: vfio/platform: Create persistent IRQ handlers (bsc#1222809).
    - CVE-2024-36945: net/smc: fix neighbour and rtable leak in smc_ib_find_route() (bsc#1225823).
    - CVE-2024-36923: fs/9p: fix uninitialized values during inode evict (bsc#1225815).
    - CVE-2024-36971: net: fix __dst_negative_advice() race (bsc#1226145).
    - CVE-2024-27414: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back (bsc#1224439).
    - CVE-2024-35900: netfilter: nf_tables: reject new basechain after table flag update (bsc#1224497).
    - CVE-2024-35886: ipv6: Fix infinite recursion in fib6_dump_done() (bsc#1224670).
    - CVE-2024-36024: drm/amd/display: Disable idle reallow as part of command/gpint execution (bsc#1225702).
    - CVE-2024-36903: ipv6: Fix potential uninit-value access in __ip6_make_skb() (bsc#1225741).
    - CVE-2024-36914: drm/amd/display: Skip on writeback when it's not applicable (bsc#1225757).
    - CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225737).
    - CVE-2024-35979: raid1: fix use-after-free for original bio in raid1_write_request() (bsc#1224572).
    - CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
    - CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
    - CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
    - CVE-2024-35898: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()     (bsc#1224498).
    - CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
    - CVE-2024-36017: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (bsc#1225681).
    - CVE-2024-36882: mm: use memalloc_nofs_save() in page_cache_ra_order() (bsc#1225723).
    - CVE-2024-36916: blk-iocost: avoid out of bounds shift (bsc#1225759).
    - CVE-2024-36900: net: hns3: fix kernel crash when devlink reload during initialization (bsc#1225726).
    - CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
    - CVE-2024-35925: block: prevent division by zero in blk_rq_stat_sum() (bsc#1224661).
    - CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
    - CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
    - CVE-2024-36934: bna: ensure the copied buf is NUL terminated (bsc#1225760).
    - CVE-2024-36935: ice: ensure the copied buf is NUL terminated (bsc#1225763).
    - CVE-2024-36937: xdp: use flags field to disambiguate broadcast redirect (bsc#1225834).
    - CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
    - CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
    - CVE-2024-36005: netfilter: nf_tables: honor table dormant flag from netdev release event path     (bsc#1224539).
    - CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
    - CVE-2024-35892: net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() (bsc#1224515).
    - CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
    - CVE-2024-35884: udp: do not accept non-tunnel GSO skbs landing in a tunnel (bsc#1224520).
    - CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
    - CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
    - CVE-2024-35926: crypto: iaa - Fix async_disable descriptor leak (bsc#1224655).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
    - CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
    - CVE-2024-36008: ipv4: check for NULL idev in ip_route_use_hint() (bsc#1224540).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
    - CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
    - CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2024-35880: io_uring/kbuf: hold io_buffer_list reference over mmap (bsc#1224523).
    - CVE-2024-35831: io_uring: Fix release of pinned pages when __io_uaddr_map fails (bsc#1224698).
    - CVE-2024-35827: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() (bsc#1224606).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address security updates:

    [4.1.12-124.88.3]- crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)  [Orabug: 36806710]     {CVE-2023-52813}- usbnet: sanity check for maxpacket (Oliver Neukum)  [Orabug: 36806658]     {CVE-2021-47495}- phonet: fix rtm_phonet_notify() skb allocation (Eric Dumazet)  [Orabug: 36683487]     {CVE-2024-36946}- wifi: nl80211: don't free NULL coalescing rule (Johannes Berg)  [Orabug: 36683466]     {CVE-2024-36941}- bna: ensure the copied buf is NUL terminated (Bui Quang Minh)  [Orabug: 36683433]     {CVE-2024-36934}- bna: use memdup_user to copy userspace buffers (Ivan Vecera)  [Orabug: 36683433]     {CVE-2024-36934}- new helper: memdup_user_nul() (Al Viro)  [Orabug: 36683433]  {CVE-2024-36934}-     netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Ziyang Xuan)  [Orabug: 36598047]     {CVE-2024-27020}- netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Pablo Neira     Ayuso)  [Orabug: 36598047]  {CVE-2024-27020}- net/mlx5e: drop shorter ethernet frames (Manjunath Patil)     [Orabug: 36879159]  {CVE-2024-41090} {CVE-2024-41091}[4.1.12-124.88.2]- net: usb: smsc75xx: Fix uninit-     value access in __smsc75xx_read_reg (Shigeru Yoshida)  [Orabug: 36802310]  {CVE-2023-52528}-     usbnet/smsc75xx: silence uninitialized variable warning (Dan Carpenter)   {CVE-2023-52528}- tty: n_gsm:
    require CAP_NET_ADMIN to attach N_GSM0710 ldisc (Thadeu Lima de Souza Cascardo)  [Orabug: 36685663]     {CVE-2023-52880}- netfilter: nf_tables: disallow anonymous set with timeout flag (Pablo Neira Ayuso)     [Orabug: 36530112]  {CVE-2024-26642}- ubi: Check for too small LEB size in VTBL code (Richard Weinberger)     [Orabug: 36356637]  {CVE-2024-25739}[4.1.12-124.88.1]- NFS: LOOKUP_DIRECTORY is also ok with symlinks     (Trond Myklebust)  [Orabug: 33958156]  {CVE-2022-24448}- NFSv4: Handle case where the lookup of a     directory fails (Trond Myklebust)  [Orabug: 33958156]  {CVE-2022-24448}

Tenable has extracted the preceding description block directly from the OracleVM security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12570 advisory.

    - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)  [Orabug: 36806710]  {CVE-2023-52813}
    - usbnet: sanity check for maxpacket (Oliver Neukum)  [Orabug: 36806658]  {CVE-2021-47495}
    - phonet: fix rtm_phonet_notify() skb allocation (Eric Dumazet)  [Orabug: 36683487]  {CVE-2024-36946}
    - wifi: nl80211: don't free NULL coalescing rule (Johannes Berg)  [Orabug: 36683466]  {CVE-2024-36941}
    - bna: ensure the copied buf is NUL terminated (Bui Quang Minh)  [Orabug: 36683433]  {CVE-2024-36934}
    - bna: use memdup_user to copy userspace buffers (Ivan Vecera)  [Orabug: 36683433]  {CVE-2024-36934}
    - new helper: memdup_user_nul() (Al Viro)  [Orabug: 36683433]  {CVE-2024-36934}
    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Ziyang Xuan)  [Orabug: 36598047]     {CVE-2024-27020}
    - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Pablo Neira Ayuso)  [Orabug:
    36598047]  {CVE-2024-27020}
    - net/mlx5e: drop shorter ethernet frames (Manjunath Patil)  [Orabug: 36879159]  {CVE-2024-41090}     {CVE-2024-41091}
    - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)  [Orabug: 36802310]     {CVE-2023-52528}
    - usbnet/smsc75xx: silence uninitialized variable warning (Dan Carpenter)   {CVE-2023-52528}
    - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (Thadeu Lima de Souza Cascardo)  [Orabug:
    36685663]  {CVE-2023-52880}
    - netfilter: nf_tables: disallow anonymous set with timeout flag (Pablo Neira Ayuso)  [Orabug: 36530112]     {CVE-2024-26642}
    - ubi: Check for too small LEB size in VTBL code (Richard Weinberger)  [Orabug: 36356637]     {CVE-2024-25739}
    - NFS: LOOKUP_DIRECTORY is also ok with symlinks (Trond Myklebust)  [Orabug: 33958156]  {CVE-2022-24448}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12571 advisory.

    - crypto: pcrypt - Fix hungtask for PADATA_RESET (Lu Jialin)  [Orabug: 36806710]  {CVE-2023-52813}
    - usbnet: sanity check for maxpacket (Oliver Neukum)  [Orabug: 36806658]  {CVE-2021-47495}
    - phonet: fix rtm_phonet_notify() skb allocation (Eric Dumazet)  [Orabug: 36683487]  {CVE-2024-36946}
    - wifi: nl80211: don't free NULL coalescing rule (Johannes Berg)  [Orabug: 36683466]  {CVE-2024-36941}
    - bna: ensure the copied buf is NUL terminated (Bui Quang Minh)  [Orabug: 36683433]  {CVE-2024-36934}
    - bna: use memdup_user to copy userspace buffers (Ivan Vecera)  [Orabug: 36683433]  {CVE-2024-36934}
    - new helper: memdup_user_nul() (Al Viro)  [Orabug: 36683433]  {CVE-2024-36934}
    - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Ziyang Xuan)  [Orabug: 36598047]     {CVE-2024-27020}
    - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Pablo Neira Ayuso)  [Orabug:
    36598047]  {CVE-2024-27020}
    - net/mlx5e: drop shorter ethernet frames (Manjunath Patil)  [Orabug: 36879159]  {CVE-2024-41090}     {CVE-2024-41091}
    - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Shigeru Yoshida)  [Orabug: 36802310]     {CVE-2023-52528}
    - usbnet/smsc75xx: silence uninitialized variable warning (Dan Carpenter)   {CVE-2023-52528}
    - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (Thadeu Lima de Souza Cascardo)  [Orabug:
    36685663]  {CVE-2023-52880}
    - netfilter: nf_tables: disallow anonymous set with timeout flag (Pablo Neira Ayuso)  [Orabug: 36530112]     {CVE-2024-26642}
    - ubi: Check for too small LEB size in VTBL code (Richard Weinberger)  [Orabug: 36356637]     {CVE-2024-25739}
    - NFS: LOOKUP_DIRECTORY is also ok with symlinks (Trond Myklebust)  [Orabug: 33958156]  {CVE-2022-24448}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2571-1 advisory.

    The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
    - CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225098).
    - CVE-2024-38610: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() (bsc#1226758).
    - CVE-2024-37354: btrfs: fix crash on racing fsync and size-extending write into prealloc (bsc#1227101).
    - CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
    - CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
    - CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
    - CVE-2023-52840: Fix use after free in rmi_unregister_function() (bsc#1224928).
    - CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595).
    - CVE-2023-52834: atl1c: Work around the DMA RX overflow issue (bsc#1225599).
    - CVE-2023-52875: Add check for mtk_alloc_clk_data (bsc#1225096).
    - CVE-2023-52865: Add check for mtk_alloc_clk_data (bsc#1225086).
    - CVE-2023-52821: Fixed a possible null pointer dereference (bsc#1225022).
    - CVE-2023-52867: Fixed possible buffer overflow (bsc#1225009).
    - CVE-2024-38578: ecryptfs: Fix buffer size for tag 66 packet (bsc#1226634,).
    - CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
    - CVE-2023-52759: Ignore negated quota changes (bsc#1225560).
    - CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
    - CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs     (bsc#1225097).
    - CVE-2023-52864: Fixed opening of char device (bsc#1225132).
    - CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).
    - CVE-2023-52871: Handle a second device without data corruption (bsc#1225534)
    - CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
    - CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
    - CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).
    - CVE-2024-39301: net/9p: fix uninit-value in p9_client_rpc() (bsc#1226994).
    - CVE-2024-35843: iommu/vt-d: Use device rbtree in iopf reporting path (bsc#1224751).
    - CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting (bsc#1227066).
    - CVE-2024-35247: fpga: region: add owner module and take its refcount (bsc#1226948).
    - CVE-2024-36479: fpga: bridge: add owner module and take its refcount (bsc#1226949).
    - CVE-2024-37021: fpga: manager: add owner module and take its refcount (bsc#1226950).
    - CVE-2024-36281: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules     (bsc#1226799).
    - CVE-2024-38580: epoll: be better about file lifetimes (bsc#1226610).
    - CVE-2024-36478: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'     (bsc#1226841).
    - CVE-2024-38636: f2fs: multidev: fix to recognize valid zero block address (bsc#1226879).
    - CVE-2024-38661: s390/ap: Fix crash in AP internal function modify_bitmap() (bsc#1226996).
    - CVE-2024-38564: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE     (bsc#1226789).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).
    - CVE-2024-36978: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (bsc#1226514).
    - CVE-2024-36917: block: fix overflow in blk_ioctl_discard() (bsc#1225770).
    - CVE-2024-38627: stm class: Fix a double free in stm_register_device() (bsc#1226857).
    - CVE-2024-38603: drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset() (bsc#1226842).
    - CVE-2024-38553: net: fec: remove .ndo_poll_controller to avoid deadlock (bsc#1226744).
    - CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
    - CVE-2024-38556: net/mlx5: Add a timeout to acquire the command queue semaphore (bsc#1226774).
    - CVE-2024-38557: net/mlx5: Reload only IB representors upon lag disable/enable (bsc#1226781).
    - CVE-2024-38608: net/mlx5e: Fix netif state handling (bsc#1226746).
    - CVE-2024-38597: eth: sungem: remove .ndo_poll_controller to avoid deadlocks (bsc#1226749).
    - CVE-2024-38594: net: stmmac: move the EST lock to struct stmmac_priv (bsc#1226734).
    - CVE-2024-38569: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group (bsc#1226772).
    - CVE-2024-38568: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group (bsc#1226771).
    - CVE-2024-26814: vfio/fsl-mc: Block calling interrupt handler without trigger (bsc#1222810).
    - CVE-2024-26813: vfio/platform: Create persistent IRQ handlers (bsc#1222809).
    - CVE-2024-36945: net/smc: fix neighbour and rtable leak in smc_ib_find_route() (bsc#1225823).
    - CVE-2024-36923: fs/9p: fix uninitialized values during inode evict (bsc#1225815).
    - CVE-2024-36971: net: fix __dst_negative_advice() race (bsc#1226145).
    - CVE-2024-27414: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back (bsc#1224439).
    - CVE-2024-35886: ipv6: Fix infinite recursion in fib6_dump_done() (bsc#1224670).
    - CVE-2024-36024: drm/amd/display: Disable idle reallow as part of command/gpint execution (bsc#1225702).
    - CVE-2024-36903: ipv6: Fix potential uninit-value access in __ip6_make_skb() (bsc#1225741).
    - CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225737).
    - CVE-2024-35979: raid1: fix use-after-free for original bio in raid1_write_request() (bsc#1224572).
    - CVE-2024-35807: ext4: fix corruption during on-line resize (bsc#1224735).
    - CVE-2023-52622: ext4: avoid online resizing failures due to oversized flex bg (bsc#1222080).
    - CVE-2023-52843: llc: verify mac len before reading mac header (bsc#1224951).
    - CVE-2024-35898: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()     (bsc#1224498).
    - CVE-2024-36915: nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies (bsc#1225758).
    - CVE-2024-36882: mm: use memalloc_nofs_save() in page_cache_ra_order() (bsc#1225723).
    - CVE-2024-36916: blk-iocost: avoid out of bounds shift (bsc#1225759).
    - CVE-2024-36900: net: hns3: fix kernel crash when devlink reload during initialization (bsc#1225726).
    - CVE-2023-52787: blk-mq: make sure active queue usage is held for bio_integrity_prep() (bsc#1225105).
    - CVE-2024-35925: block: prevent division by zero in blk_rq_stat_sum() (bsc#1224661).
    - CVE-2023-52837: nbd: fix uaf in nbd_open (bsc#1224935).
    - CVE-2023-52786: ext4: fix racy may inline data check in dio write (bsc#1224939).
    - CVE-2024-36934: bna: ensure the copied buf is NUL terminated (bsc#1225760).
    - CVE-2024-36935: ice: ensure the copied buf is NUL terminated (bsc#1225763).
    - CVE-2024-36937: xdp: use flags field to disambiguate broadcast redirect (bsc#1225834).
    - CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage (bsc#1224614).
    - CVE-2023-52845: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (bsc#1225585).
    - CVE-2024-36005: netfilter: nf_tables: honor table dormant flag from netdev release event path     (bsc#1224539).
    - CVE-2024-26845: scsi: target: core: Add TMF to tmr_list handling (bsc#1223018).
    - CVE-2024-35892: net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() (bsc#1224515).
    - CVE-2024-35848: eeprom: at24: fix memory corruption race condition (bsc#1224612).
    - CVE-2024-35884: udp: do not accept non-tunnel GSO skbs landing in a tunnel (bsc#1224520).
    - CVE-2024-35857: icmp: prevent possible NULL dereferences from icmp_build_probe() (bsc#1224619).
    - CVE-2023-52735: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself (bsc#1225475).
    - CVE-2024-35926: crypto: iaa - Fix async_disable descriptor leak (bsc#1224655).
    - CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
    - CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
    - CVE-2024-36008: ipv4: check for NULL idev in ip_route_use_hint() (bsc#1224540).
    - CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).
    - CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
    - CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
    - CVE-2024-36957: octeontx2-af: avoid off-by-one read from userspace (bsc#1225762).
    - CVE-2024-26625: Call sock_orphan() at release time (bsc#1221086)
    - CVE-2024-35880: io_uring/kbuf: hold io_buffer_list reference over mmap (bsc#1224523).
    - CVE-2024-35831: io_uring: Fix release of pinned pages when __io_uaddr_map fails (bsc#1224698).
    - CVE-2024-35827: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() (bsc#1224606).
    - CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
    - CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held (bsc#1224659).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4211 advisory.

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

    * kernel: ovl: fix leaked entry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

    * kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

    * kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

    * kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

    * kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

    * kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10]     (CVE-2024-27397)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

    * kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

    * kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804,     CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:Rocky Linux-29783)

    * Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:Rocky Linux-35361)

    * Rocky Linux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:Rocky Linux-36048)

    * [Rocky Linux8] blktests block/024 failed (JIRA:Rocky Linux-8130)

    * Rocky Linux8.9: EEH injections results  Error:  Power fault on Port 0 and other call     traces(Everest/1050/Shiner) (JIRA:Rocky Linux-14195)

    * Latency spikes with Matrox G200 graphic cards (JIRA:Rocky Linux-36172)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4352 advisory.

    * kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583

    * kernel-rt: kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)

    * kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero  (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

    * kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)

    * kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: ovl: fix leaked dentry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)

    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)

    * kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52813)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: usb: (CVE-2023-52781, CVE-2023-52877)

    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

    * kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)

    * kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)

    * kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)

    * kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)

    * kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest Rocky Linux-8.10.z kernel (JIRA:Rocky Linux-40882)

    * [rhel8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735 (JIRA:Rocky     Linux-8779)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:4352 advisory.

    * kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583
    * kernel-rt: kernel: PCI interrupt mapping cause oops [almalinux-8] (CVE-2021-46909)
    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)
    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)
    * kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)
    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)
    * kernel: Squashfs: check the inode number is not the invalid value of zero  (CVE-2024-26982)
    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)
    * kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)
    * kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)
    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)
    * kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)
    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
    * kernel: ovl: fix leaked dentry (CVE-2021-46972)
    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
    * kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)
    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)
    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
    * kernel: crypto: (CVE-2024-26974, CVE-2023-52813)
    * kernel: can: (CVE-2023-52878, CVE-2021-47456)
    * kernel: usb: (CVE-2023-52781, CVE-2023-52877)
    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
    * kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)
    * kernel: gro: fix ownership transfer (CVE-2024-35890)
    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)
    * kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)
    * kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)
    * kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)
    * kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)
    * kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)
    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest AlmaLinux-8.10.z kernel (JIRA:AlmaLinux-40882)
    * [almalinux8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735     (JIRA:AlmaLinux-8779)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4352 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tls (CVE-2024-26585,CVE-2024-26584, CVE-2024-26583

    * kernel-rt: kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng (CVE-2023-52615)

    * kernel-rt: kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero  (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

    * kernel: wifi: mac80211: (CVE-2024-35789, CVE-2024-35838, CVE-2024-35845)

    * kernel: wifi: nl80211: reject iftype change with mesh ID change (CVE-2024-27410)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel:TCP-spoofed ghost ACKs and leak initial sequence number (CVE-2023-52881)

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: ovl: fix leaked dentry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)

    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)

    * kernel: net/usb: kalmia: avoid printing uninitialized value on error path (CVE-2023-52703)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52813)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: usb: (CVE-2023-52781, CVE-2023-52877)

    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)

    * kernel: usbnet: sanity check for maxpacket (CVE-2021-47495)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: tipc: fix kernel warning when sending SYN message (CVE-2023-52700)

    * kernel: net/mlx5/mlxsw: (CVE-2024-35960, CVE-2024-36007, CVE-2024-35855)

    * kernel: net/mlx5e: (CVE-2024-35959, CVE-2023-52626, CVE-2024-35835)

    * kernel: mlxsw: (CVE-2024-35854, CVE-2024-35853, CVE-2024-35852)

    * kernel: net: (CVE-2024-35958, CVE-2021-47311, CVE-2021-47236, CVE-2021-47310)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-8.10.z kernel (JIRA:RHEL-40882)

    * [rhel8.9][cxgb4]BUG: using smp_processor_id() in preemptible [00000000] code: ethtool/54735     (JIRA:RHEL-8779)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4211 advisory.

    - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353}
    - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310}
    - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909}
    - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004}
    - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959}
    - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960}
    - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091]     {CVE-2023-52667}
    - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958}
    - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763]     {CVE-2021-47356}
    - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763]     {CVE-2021-47356}
    - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974}
    - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974}
    - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826}
    - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735}
    - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243]     {CVE-2024-26859}
    - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090}
    - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464}
    - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311}
    - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268]     {CVE-2023-52835}
    - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813}
    - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656}
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008]     {CVE-2024-35854}
    - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004]     {CVE-2024-35855}
    - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853}
    - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016]     {CVE-2024-35852}
    - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007}
    - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456}
    - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440]     {CVE-2021-47495}
    - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
    - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835}
    - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose     Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878}
    - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236}
    - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez)     [RHEL-38113] {CVE-2023-52703}
    - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248]     {CVE-2023-52877}
    - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240]     {CVE-2023-52781}
    - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890}
    - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700}
    - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888}
    - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023]     {CVE-2024-27397}
    - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669}
    - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026]     {CVE-2024-35845}
    - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838}
    - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884]     {CVE-2024-27410}
    - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez)     [RHEL-36807] {CVE-2024-35789}
    - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826]     {CVE-2024-26801}
    - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26584     CVE-2024-26583 CVE-2024-26585}
    - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096]     {CVE-2024-26982}
    - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782]     {CVE-2021-47069}
    - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
    - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582]     {CVE-2023-52626}
    - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615}
    - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058]     {CVE-2023-52686}
    - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804}
    - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162]     {CVE-2024-26907}
    - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972}
    - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166]     {CVE-2024-26906}
    - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
    - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166]     {CVE-2024-26906}
    - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
    - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
    - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
    - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644]     {CVE-2024-26759}
    - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294]     {CVE-2023-52560}
    - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790]     {CVE-2021-47073}
    - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017]     {CVE-2020-26555}
    - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555}
    - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675}
    - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078]     {CVE-2023-52675}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:4211 advisory.

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
    * kernel:TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)
    * kernel: ovl: fix leaked dentry (CVE-2021-46972)
    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)
    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)
    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)
    * kernel: mm/swap: fix race when skipping swapcache (CVE-2024-26759)
    * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)
    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)
    * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906)
    * kernel: powerpc/powernv: Add a null pointer check in opal_event_init() (CVE-2023-52686)
    * kernel: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (CVE-2023-52675)
    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)
    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)
    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)
    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)
    * kernel: net/bnx2x: Prevent access to a freed page in page_pool (CVE-2024-26859)
    * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974)
    * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667)
    * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960)
    * kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow (CVE-2024-35959)
    * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958)
    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)
    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)
    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)
    * kernel: net: ti: fix UAF in tlan_remove_one (CVE-2021-47310)

    Bug Fix(es):

    * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:AlmaLinux-29783)
    * Temporary values in FIPS integrity test should be zeroized [almalinux-8.10.z] (JIRA:AlmaLinux-35361)
    * AlmaLinux8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:AlmaLinux-36048)
    * [AlmaLinux8] blktests block/024 failed (JIRA:AlmaLinux-8130)
    * AlmaLinux8.9: EEH injections results  Error:  Power fault on Port 0 and other call     traces(Everest/1050/Shiner) (JIRA:AlmaLinux-14195)
    * Latency spikes with Matrox G200 graphic cards (JIRA:AlmaLinux-36172)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4211 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

    * kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001)

    * kernel: ovl: fix leaked entry (CVE-2021-46972)

    * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073)

    * kernel: gro: fix ownership transfer (CVE-2024-35890)

    * kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585)

    * kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845)

    * kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007)

    * kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909)

    * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069)

    * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615)

    * kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959)

    * kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656)

    * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801)

    * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10]     (CVE-2024-27397)

    * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560)

    * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675)

    * kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906)

    * kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700)

    * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907)

    * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888)

    * kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686)

    * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic     msrs (CVE-2023-5090)

    * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464)

    * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735)

    * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

    * kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813)

    * kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804,     CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703)

    * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004)

    * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    * kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495)

    * kernel: can: (CVE-2023-52878, CVE-2021-47456)

    * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356)

    * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353)

    Bug Fix(es):

    * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:RHEL-29783)

    * Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:RHEL-35361)

    * RHEL8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:RHEL-36048)

    * [RHEL8] blktests block/024 failed (JIRA:RHEL-8130)

    * RHEL8.9: EEH injections results  Error:  Power fault on Port 0 and other call     traces(Everest/1050/Shiner) (JIRA:RHEL-14195)

    * Latency spikes with Matrox G200 graphic cards (JIRA:RHEL-36172)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.334-252.552. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2391 advisory.

    2024-12-05: CVE-2023-52809 was added to this advisory.

    2024-12-05: CVE-2023-52759 was added to this advisory.

    2024-11-08: CVE-2023-52819 was added to this advisory.

    2024-11-08: CVE-2023-52818 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-02-01: CVE-2023-0590 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. (CVE-2023-0590)

    A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel.
    (CVE-2023-39198)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: ignore negated quota changes (CVE-2023-52759)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (CVE-2023-52818)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (CVE-2023-52819)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.205-195.804. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-045 advisory.

    2024-12-05: CVE-2023-52835 was added to this advisory.

    2024-12-05: CVE-2023-52781 was added to this advisory.

    2024-12-05: CVE-2023-52828 was added to this advisory.

    2024-12-05: CVE-2023-52759 was added to this advisory.

    2024-12-05: CVE-2023-52809 was added to this advisory.

    2024-12-05: CVE-2023-52791 was added to this advisory.

    2024-11-08: CVE-2023-52819 was added to this advisory.

    2024-11-08: CVE-2023-52818 was added to this advisory.

    2024-11-08: CVE-2023-52814 was added to this advisory.

    2024-08-27: CVE-2023-52654 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    2024-01-19: CVE-2023-6531 was added to this advisory.

    A race condition leading to a use-after-free issue was found in the QXL driver in the Linux kernel.
    (CVE-2023-39198)

    An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-52654)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: ignore negated quota changes (CVE-2023-52759)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix potential null pointer derefernce (CVE-2023-52814)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (CVE-2023-52818)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (CVE-2023-52819)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Detect IP == ksym.end as part of BPF program (CVE-2023-52828)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double     deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

    We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.145-95.156. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-033 advisory.

    2024-12-05: CVE-2023-52772 was added to this advisory.

    2024-12-05: CVE-2023-52835 was added to this advisory.

    2024-12-05: CVE-2023-52781 was added to this advisory.

    2024-12-05: CVE-2023-52828 was added to this advisory.

    2024-12-05: CVE-2023-52788 was added to this advisory.

    2024-12-05: CVE-2023-52791 was added to this advisory.

    2024-08-27: CVE-2023-52654 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-07-03: CVE-2023-52762 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-06-06: CVE-2024-0607 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    2024-01-19: CVE-2023-6531 was added to this advisory.

    An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an     io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. (CVE-2023-46862)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-52654)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-blk: fix implicit overflow on virtio_max_dma_size (CVE-2023-52762)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: fix use-after-free in unix_stream_read_actor() (CVE-2023-52772)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i915/perf: Fix NULL deref bugs with drm_dbg() calls (CVE-2023-52788)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Detect IP == ksym.end as part of BPF program (CVE-2023-52828)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double     deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

    We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

    netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.265-176.364. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-057 advisory.

    2024-12-05: CVE-2023-52809 was added to this advisory.

    2024-12-05: CVE-2023-52791 was added to this advisory.

    2024-12-05: CVE-2023-52759 was added to this advisory.

    2024-12-05: CVE-2023-52835 was added to this advisory.

    2024-11-08: CVE-2023-52819 was added to this advisory.

    2024-11-08: CVE-2023-52818 was added to this advisory.

    2024-08-27: CVE-2023-52654 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-03-27: CVE-2023-52433 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    2024-01-19: CVE-2023-6531 was added to this advisory.

    2024-01-19: CVE-2023-4244 was added to this advisory.

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage     collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.

    We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8. (CVE-2023-4244)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction

    New elements in this transaction might expired before such transactionends. Skip sync GC for such elements     otherwise commit path might walkover an already released object. Once transaction is finished, async     GCwill collect such expired element. (CVE-2023-52433)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-52654)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: ignore negated quota changes (CVE-2023-52759)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (CVE-2023-52818)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (CVE-2023-52819)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.334-177.552. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2024-1899 advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-06-07: CVE-2023-52881 was added to this advisory.

    2024-02-01: CVE-2023-0590 was added to this advisory.

    2024-01-19: CVE-2023-52340 was added to this advisory.

    A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. (CVE-2023-0590)

    When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet     Too Big (PTB) message to the sender. The sender caches this updated Maximum Transmission Unit (MTU) so it     knows not to exceed this value when subsequently routing to the same host.

    In Linux kernels prior to 6.3, garbage collection is run on the IPv6 Destination Route Cache if the number     of entries exceeds a threshold when adding the destination to the cache. This garbage collection examines     every entry in the cache while holding a lock. In these affected kernel versions, a flood of the IPv6     ICMP6 PTB messages could cause high lock contention and increased CPU usage, leading to a Denial-of-     Service.

    The fix backports the garbage collection improvements from Linux kernel 6.3 by bringing the IPv6 code     closer to the IPv4 code, which does not have this issue.

    Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c3     7799f0d5576ccef277 (CVE-2023-52340)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-461 advisory.

    2024-12-05: CVE-2023-52843 was added to this advisory.

    2024-12-05: CVE-2023-52859 was added to this advisory.

    2024-12-05: CVE-2023-52788 was added to this advisory.

    2024-12-05: CVE-2023-52846 was added to this advisory.

    2024-12-05: CVE-2023-52868 was added to this advisory.

    2024-12-05: CVE-2023-52831 was added to this advisory.

    2024-12-05: CVE-2023-52854 was added to this advisory.

    2024-12-05: CVE-2023-52869 was added to this advisory.

    2024-12-05: CVE-2023-52772 was added to this advisory.

    2024-12-05: CVE-2023-52791 was added to this advisory.

    2024-12-05: CVE-2023-52781 was added to this advisory.

    2024-12-05: CVE-2023-52835 was added to this advisory.

    2024-12-05: CVE-2023-52828 was added to this advisory.

    2024-11-13: CVE-2023-52752 was added to this advisory.

    2024-07-03: CVE-2023-52840 was added to this advisory.

    2024-07-03: CVE-2023-6622 was added to this advisory.

    2024-07-03: CVE-2023-52813 was added to this advisory.

    2024-07-03: CVE-2023-52762 was added to this advisory.

    2024-06-19: CVE-2023-52860 was added to this advisory.

    2024-06-19: CVE-2023-52796 was added to this advisory.

    2024-06-19: CVE-2023-52803 was added to this advisory.

    2024-06-19: CVE-2023-52784 was added to this advisory.

    2024-06-19: CVE-2023-52778 was added to this advisory.

    2024-02-01: CVE-2024-0584 was added to this advisory.

    2024-02-01: CVE-2024-0607 was added to this advisory.

    2024-01-03: CVE-2023-6932 was added to this advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (CVE-2023-52752)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-blk: fix implicit overflow on virtio_max_dma_size (CVE-2023-52762)

    In the Linux kernel, the following vulnerability has been resolved:

    af_unix: fix use-after-free in unix_stream_read_actor() (CVE-2023-52772)

    In the Linux kernel, the following vulnerability has been resolved:

    mptcp: deal with large GSO size (CVE-2023-52778)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781)

    In the Linux kernel, the following vulnerability has been resolved:

    bonding: stop the device in bond_setup_by_slave() (CVE-2023-52784)

    In the Linux kernel, the following vulnerability has been resolved:

    i915/perf: Fix NULL deref bugs with drm_dbg() calls (CVE-2023-52788)

    In the Linux kernel, the following vulnerability has been resolved:

    i2c: core: Run atomic i2c xfer when !preemptible (CVE-2023-52791)

    In the Linux kernel, the following vulnerability has been resolved:

    ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796)

    In the Linux kernel, the following vulnerability has been resolved:

    SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (CVE-2023-52803)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: pcrypt - Fix hungtask for PADATA_RESET (CVE-2023-52813)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Detect IP == ksym.end as part of BPF program (CVE-2023-52828)

    In the Linux kernel, the following vulnerability has been resolved:

    cpu/hotplug: Don't offline the last non-isolated CPU (CVE-2023-52831)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835)

    In the Linux kernel, the following vulnerability has been resolved:

    Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CVE-2023-52840)

    In the Linux kernel, the following vulnerability has been resolved:

    llc: verify mac len before reading mac header (CVE-2023-52843)

    In the Linux kernel, the following vulnerability has been resolved:

    hsr: Prevent use after free in prp_create_tagged_frame() (CVE-2023-52846)

    In the Linux kernel, the following vulnerability has been resolved:

    padata: Fix refcnt handling in padata_free_shell() (CVE-2023-52854)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: hisi: Fix use-after-free when register pmu fails (CVE-2023-52859)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process     (CVE-2023-52860)

    In the Linux kernel, the following vulnerability has been resolved:

    thermal: core: prevent potential string overflow (CVE-2023-52868)

    In the Linux kernel, the following vulnerability has been resolved:

    pstore/platform: Add check for kstrdup (CVE-2023-52869)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the     argument sync is true, making it possible to free a catchall set element many times.

    We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. (CVE-2023-6111)

    A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in     nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to     trigger a denial of service. (CVE-2023-6622)

    A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation.

    A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object     which is freed by another thread.

    We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

    A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in     the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an     igmp query packet, leading to a kernel information leak. (CVE-2024-0584)

    netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() (CVE-2024-0607)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211575	Oracle Linux 9 : kernel (ELSA-2024-9315)	Nessus	Oracle Linux Local Security Checks	high
210815	RHEL 9 : kernel (RHSA-2024:9315)	Nessus	Red Hat Local Security Checks	high
207170	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2024-2369)	Nessus	Huawei Local Security Checks	high
207166	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2024-2441)	Nessus	Huawei Local Security Checks	high
207151	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2024-2418)	Nessus	Huawei Local Security Checks	high
207120	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2024-2394)	Nessus	Huawei Local Security Checks	high
206008	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2973-1)	Nessus	SuSE Local Security Checks	high
205492	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2896-1)	Nessus	SuSE Local Security Checks	high
205210	OracleVM 3.4 : kernel-uek (OVMSA-2024-0010)	Nessus	OracleVM Local Security Checks	high
205006	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2024-12570)	Nessus	Oracle Linux Local Security Checks	high
205005	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2024-12571)	Nessus	Oracle Linux Local Security Checks	high
202999	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2571-1)	Nessus	SuSE Local Security Checks	high
202388	Rocky Linux 8 : kernel (RLSA-2024:4211)	Nessus	Rocky Linux Local Security Checks	high
202379	Rocky Linux 8 : kernel-rt (RLSA-2024:4352)	Nessus	Rocky Linux Local Security Checks	high
202069	AlmaLinux 8 : kernel-rt (ALSA-2024:4352)	Nessus	Alma Linux Local Security Checks	high
201943	RHEL 8 : kernel-rt (RHSA-2024:4352)	Nessus	Red Hat Local Security Checks	high
201306	Oracle Linux 8 : kernel (ELSA-2024-4211)	Nessus	Oracle Linux Local Security Checks	high
201236	AlmaLinux 8 : kernel (ALSA-2024:4211)	Nessus	Alma Linux Local Security Checks	high
201233	RHEL 8 : kernel (RHSA-2024:4211)	Nessus	Red Hat Local Security Checks	high
187832	Amazon Linux 2 : kernel (ALAS-2024-2391)	Nessus	Amazon Linux Local Security Checks	high
187779	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-045)	Nessus	Amazon Linux Local Security Checks	high
187777	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-033)	Nessus	Amazon Linux Local Security Checks	high
187776	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-057)	Nessus	Amazon Linux Local Security Checks	high
187708	Amazon Linux AMI : kernel (ALAS-2024-1899)	Nessus	Amazon Linux Local Security Checks	high
186974	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-461)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-52813

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high