A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.

An update of the linux package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4412 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation     (CVE-2024-0193)

    * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)

    * kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations     (CVE-2024-26673)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.0.z Batch 18 (JIRA:RHEL-36756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4415 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation     (CVE-2024-0193)

    * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)

    * kernel: kvm: Avoid potential UAF in LPI translation cache (CVE-2024-26598)

    * kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations     (CVE-2024-26673)

    Bug Fix(es):

    * multi-page bvec configuration for integrity payload (JIRA:RHEL-15150)

    * ipoib mcast lockup fix (JIRA:RHEL-30259)

    * Kernel panic in skb_segment (JIRA:RHEL-30560)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of     transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is     partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or     IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under     some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in
    __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800
    __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is     used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger     than the amount of data in the message iterator. This is because the requested length includes the     transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6,     SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100,     MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the     write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks     like it won't suffer from this problem as it builds the UDP packet itself.(CVE-2023-52527)

    In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in     shinker's callback The mmap read lock is used during the shrinker's callback, which means that using     alloc-vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ('mm: mmap: zap     pages with read mmap_sem in munmap') the mmap lock is downgraded after the vma has been isolated. I was     able to reproduce this issue by manually adding some delays and triggering page reclaiming through the     shrinker's debug sysfs.(CVE-2023-52438)

    A flaw in the routing table size was found in the ICMPv6 handling of  Packet Too Big . The size of the     routing table is regulated by periodic garbage collection. However, with  Packet Too Big Messages  it is     possible to exceed the routing table size and garbage collector threshold. A user located in the local     network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6     connections up to 95%.(CVE-2023-52340)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.The nft_verdict_init() function allows positive values as drop error     within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when     NF_DROP is issued with a drop error which resembles NF_ACCEPT.(CVE-2024-1086)

    A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel     hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or     potentially escalate their privileges on the system.(CVE-2024-0841)

    In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload.(CVE-2023-51043)

    A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality.(CVE-2024-0607)

    A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernels SCTP subsystem. This flaw allows guests with local user     privileges to trigger a deadlock and potentially crash the system.(CVE-2024-0639)

    A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return.(CVE-2023-6915)

    Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0.(CVE-2021-33631)

    A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernels TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system.(CVE-2024-0641)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued     on.(CVE-2023-6531)

    An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access.(CVE-2023-6040)

    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service.(CVE-2024-0565)

    An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap.(CVE-2022-48619)

    A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file.(CVE-2024-0340)

    A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow.(CVE-2023-7192)

    A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system.(CVE-2024-0193)

    An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw     allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer     (dmesg).(CVE-2023-6121)

    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel     information.(CVE-2023-6606)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group().(CVE-2023-6931)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0. (CVE-2021-33631)

  - An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap. (CVE-2022-48619)

  - In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

  - An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access. (CVE-2023-6040)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

  - A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system. (CVE-2023-6546)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set     walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-     after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

  - A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return. (CVE-2023-6915)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

  - A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow. (CVE-2023-7192)

  - A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system. (CVE-2024-0193)

  - A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file. (CVE-2024-0340)

  - An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service. (CVE-2024-0565)

  - Rejected reason: Do not use this CVE as it is duplicate of CVE-2023-6932 (CVE-2024-0584)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality. (CVE-2024-0607)

  - A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges     to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1248 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation     (CVE-2024-0193)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction (CVE-2023-4244)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c     (CVE-2023-51042)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1248 advisory.

    - drm/amdgpu: Fix potential fence use-after-free v2 (Jan Stancek) [RHEL-24501 RHEL-24504 RHEL-22506     RHEL-22507] {CVE-2023-51042}
    - netfilter: nf_tables: skip set commit for deleted/destroyed sets (Phil Sutter) [RHEL-20683 RHEL-20686     RHEL-20214 RHEL-20217] {CVE-2024-0193}
    - netfilter: nft_set_pipapo: skip inactive elements during set walk (Florian Westphal) [RHEL-20701     RHEL-20709 RHEL-19722 RHEL-19961] {CVE-2023-6817}
    - netfilter: nft_set_hash: mark set element as dead when deleting from packet path (Florian Westphal)     [RHEL-22131 RHEL-22134 RHEL-1720 RHEL-1721] {CVE-2023-4244}
    - netfilter: nf_tables: adapt set backend to use GC transaction API (Florian Westphal) [RHEL-22131     RHEL-22134 RHEL-1720 RHEL-1721] {CVE-2023-4244}
    - netfilter: nf_tables: GC transaction API to avoid race with control plane (Florian Westphal) [RHEL-22131     RHEL-22134 RHEL-1720 RHEL-1721] {CVE-2023-4244}
    - net: tls, update curr on splice as well (Sabrina Dubroca) [RHEL-22094 RHEL-22097 RHEL-19066 RHEL-19067]     {CVE-2024-0646}
    - smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-21664 RHEL-21669 RHEL-18992 RHEL-18993]     {CVE-2023-6606}
    - nvmet-tcp: Fix the H2C expected PDU len calculation (Maurizio Lombardi) [RHEL-22290 RHEL-22292     RHEL-22627 RHEL-22629 RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159 RHEL-19162     RHEL-19165] {CVE-2023-6356 CVE-2023-6535 CVE-2023-6536}
    - nvmet-tcp: remove boilerplate code (Maurizio Lombardi) [RHEL-22290 RHEL-22292 RHEL-22627 RHEL-22629     RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159 RHEL-19162 RHEL-19165] {CVE-2023-6356     CVE-2023-6535 CVE-2023-6536}
    - nvmet-tcp: fix a crash in nvmet_req_complete() (Maurizio Lombardi) [RHEL-22290 RHEL-22292 RHEL-22627     RHEL-22629 RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159 RHEL-19162 RHEL-19165]     {CVE-2023-6356 CVE-2023-6535 CVE-2023-6536}
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length (Maurizio Lombardi) [RHEL-22290     RHEL-22292 RHEL-22627 RHEL-22629 RHEL-22632 RHEL-22636 RHEL-19150 RHEL-19153 RHEL-19156 RHEL-19159     RHEL-19162 RHEL-19165] {CVE-2023-6356 CVE-2023-6535 CVE-2023-6536}
    - smb: client: fix potential OOB in smb2_dump_detail() (Scott Mayhew) [RHEL-19146 RHEL-21679 RHEL-19147     RHEL-21677] {CVE-2023-6610}
    - smb: client: fix potential OOB in cifs_dump_detail() (Scott Mayhew) [RHEL-19146 RHEL-21679 RHEL-19147     RHEL-21677] {CVE-2023-6610}
    - perf/core: Fix potential NULL deref (Wander Lairson Costa) [RHEL-18087 RHEL-18088 RHEL-14984 RHEL-14985]     {CVE-2023-5717}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows     Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from     5.10.0-60.18.0 before 5.10.0-183.0.0. (CVE-2021-33631)

  - An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap. (CVE-2022-48619)

  - In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race     condition between a nonblocking atomic commit and a driver unload. (CVE-2023-51043)

  - An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4     (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of     a safeguard against invalid nf_tables family (pf) values within `nf_tables_newtable` function enables an     attacker to achieve out-of-bounds access. (CVE-2023-6040)

  - An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue     may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that     results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
    (CVE-2023-6121)

  - A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

  - A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two     threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline     enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This     could allow a local unprivileged user to escalate their privileges on the system. (CVE-2023-6546)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set     walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-     after-free. We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

  - A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may     allow an attacker using this library to cause a denial of service problem due to a missing check at a     function return. (CVE-2023-6915)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

  - A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in     the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of     service (DoS) attack due to a refcount overflow. (CVE-2023-7192)

  - A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system. (CVE-2024-0193)

  - A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not     properly initialize memory in messages passed between virtual guests and the host operating system in the     vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net device file. (CVE-2024-0340)

  - An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service. (CVE-2024-0565)

  - Rejected reason: Do not use this CVE as it is duplicate of CVE-2023-6932 (CVE-2024-0584)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval()     function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes     are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every     iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local     user to cause a denial of service or potentially break NetFilter functionality. (CVE-2024-0607)

  - A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in     net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges     to trigger a deadlock and potentially crash the system. (CVE-2024-0639)

  - A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux     kernel's TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and     potentially crash the system. (CVE-2024-0641)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1019 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation     (CVE-2024-0193)

    * kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction (CVE-2023-4244)

    * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size     (CVE-2023-6931)

    * kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c     (CVE-2023-51042)

    * kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload     in drivers/gpu/drm/drm_atomic.c (CVE-2023-51043)

    * kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function     (CVE-2024-1085)

    * kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1018 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation     (CVE-2024-0193)

    * kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction (CVE-2023-4244)

    * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size     (CVE-2023-6931)

    * kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c     (CVE-2023-51042)

    * kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload     in drivers/gpu/drm/drm_atomic.c (CVE-2023-51043)

    * kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function     (CVE-2024-1085)

    * kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6628-2 advisory.

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel     when handling sessions operations. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

    Marek Marczykowski-Grecki discovered that the Xen event channel infrastructure implementation in the     Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a     denial of service (paravirtualized device unavailability). (CVE-2023-34324)

    Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during     device removal. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-35827)

    Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors     in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV     guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-46813)

    It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash). (CVE-2023-6039)

    Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network     family support while creating a new netfilter table. A local attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2023-6040)

    It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic     operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset     expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2023-6622)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

    It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle     locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of     service (kernel deadlock). (CVE-2024-0641)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6635-1 advisory.

    It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling     device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker     could possibly use this to cause a denial of service (system crash). (CVE-2023-37453)

    Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate some     attributes passed from userspace. A local attacker could use this to cause a denial of service (system     crash) or possibly expose sensitive information (kernel memory). (CVE-2023-39189)

    Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did not properly validate u32     packets content, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause     a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-39192)

    Lucas Leong discovered that the netfilter subsystem in the Linux kernel did not properly validate SCTP     data, leading to an out-of-bounds read vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly expose sensitive information. (CVE-2023-39193)

    Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did not properly handle socket     buffers (skb) when performing IP routing in certain circumstances, leading to a null pointer dereference     vulnerability. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-42754)

    Jason Wang discovered that the virtio ring implementation in the Linux kernel did not properly handle iov     buffers in some situations. A local attacker in a guest VM could use this to cause a denial of service     (host system crash). (CVE-2023-5158)

    Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly handle queue     initialization failures in certain situations, leading to a use-after-free vulnerability. A remote     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-5178)

    Budimir Markovic discovered that the perf subsystem in the Linux kernel did not properly handle event     groups, leading to an out-of-bounds write vulnerability. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2023-5717)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6608-2 advisory.

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6628-1 advisory.

    Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel     when handling sessions operations. A remote attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-32250, CVE-2023-32252, CVE-2023-32257)

    Marek Marczykowski-Grecki discovered that the Xen event channel infrastructure implementation in the     Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a     denial of service (paravirtualized device unavailability). (CVE-2023-34324)

    Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during     device removal. A privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2023-35827)

    Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors     in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV     guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2023-46813)

    It was discovered that the Microchip USB Ethernet driver in the Linux kernel contained a race condition     during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could     use this to cause a denial of service (system crash). (CVE-2023-6039)

    Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network     family support while creating a new netfilter table. A local attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2023-6040)

    It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic     operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset     expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2023-6622)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

    It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle     locking during tipc_crypto_key_revoke() operations. A local attacker could use this to cause a denial of     service (kernel deadlock). (CVE-2024-0641)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6609-3 advisory.

    Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network     family support while creating a new netfilter table. A local attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2023-6040)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6609-2 advisory.

    Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network     family support while creating a new netfilter table. A local attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2023-6040)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6606-1 advisory.

    It was discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2023-51779)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6608-1 advisory.

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6609-1 advisory.

    Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network     family support while creating a new netfilter table. A local attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2023-6040)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6607-1 advisory.

    It was discovered that the SMB network file sharing protocol implementation in the Linux kernel did not     properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2023-5345)

    Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network     family support while creating a new netfilter table. A local attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2023-6040)

    It was discovered that the CIFS network file system implementation in the Linux kernel did not properly     validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An     attacker could use this to construct a malicious CIFS image that, when operated on, could cause a denial     of service (system crash) or possibly expose sensitive information. (CVE-2023-6606)

    Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle inactive     elements in its PIPAPO data structure, leading to a use-after-free vulnerability. A local attacker could     use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6817)

    Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf subsystem in the Linux kernel     did not properly validate all event sizes when attaching new events, leading to an out-of-bounds write     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2023-6931)

    It was discovered that the IGMP protocol implementation in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-6932)

    Kevin Rich discovered that the netfilter subsystem in the Linux kernel did not properly check deactivated     elements in certain situations, leading to a use-after-free vulnerability. A local attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-0193)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.205-195.807. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-046 advisory.

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system. (CVE-2024-0193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.15.145-95.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-034 advisory.

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system. (CVE-2024-0193)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-488 advisory.

    2024-08-14: CVE-2023-52654 was added to this advisory.

    2024-06-06: CVE-2023-52881 was added to this advisory.

    2024-05-23: CVE-2023-6531 was added to this advisory.

    2024-05-09: CVE-2023-6931 was added to this advisory.

    2024-04-25: CVE-2023-6817 was added to this advisory.

    2024-04-10: CVE-2024-25744 was added to this advisory.

    2024-02-01: CVE-2024-0646 was added to this advisory.

    2024-02-01: CVE-2024-0565 was added to this advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring/af_unix: disable sending io_uring over sockets (CVE-2023-52654)

    In the Linux kernel, the following vulnerability has been resolved:

    tcp: do not accept ACK of bytes we never sent (CVE-2023-52881)

    A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's     deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
    (CVE-2023-6531)

    An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

    A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation.

    The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double     deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.

    We recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a. (CVE-2023-6817)

    A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation.

    A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in     perf_read_group().

    We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

    A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is     garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a     use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with     CAP_NET_ADMIN capability to escalate their privileges on the system. (CVE-2024-0193)

    An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in     the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy     length, leading to a denial of service. (CVE-2024-0565)

    An out-of-bounds memory write flaw was found in the Linux kernel's Transport Layer Security functionality     in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user     to crash or potentially escalate their privileges on the system. (CVE-2024-0646)

    In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point.
    This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. (CVE-2024-25744)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204220	Photon OS 5.0: Linux PHSA-2024-5.0-0198	Nessus	PhotonOS Local Security Checks	high
202007	RHEL 9 : kernel-rt (RHSA-2024:4412)	Nessus	Red Hat Local Security Checks	high
202002	RHEL 9 : kernel (RHSA-2024:4415)	Nessus	Red Hat Local Security Checks	high
198192	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1764)	Nessus	Huawei Local Security Checks	high
198188	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1741)	Nessus	Huawei Local Security Checks	high
197149	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2024-1608)	Nessus	Huawei Local Security Checks	high
197126	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2024-1627)	Nessus	Huawei Local Security Checks	high
194440	RHEL 9 : kernel (RHSA-2024:1248)	Nessus	Red Hat Local Security Checks	high
192199	Oracle Linux 9 : kernel (ELSA-2024-1248)	Nessus	Oracle Linux Local Security Checks	high
191854	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2024-1215)	Nessus	Huawei Local Security Checks	high
191826	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2024-1237)	Nessus	Huawei Local Security Checks	high
191092	RHEL 9 : kernel-rt (RHSA-2024:1019)	Nessus	Red Hat Local Security Checks	high
191090	RHEL 9 : kernel (RHSA-2024:1018)	Nessus	Red Hat Local Security Checks	high
190560	Ubuntu 20.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6628-2)	Nessus	Ubuntu Local Security Checks	high
190521	Ubuntu 22.04 LTS : Linux kernel (GCP) vulnerabilities (USN-6635-1)	Nessus	Ubuntu Local Security Checks	high
190519	Ubuntu 22.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-6608-2)	Nessus	Ubuntu Local Security Checks	high
190369	Ubuntu 22.04 LTS : Linux kernel (Intel IoTG) vulnerabilities (USN-6628-1)	Nessus	Ubuntu Local Security Checks	high
190067	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-6609-3)	Nessus	Ubuntu Local Security Checks	high
189831	Ubuntu 22.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-6609-2)	Nessus	Ubuntu Local Security Checks	high
189612	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6606-1)	Nessus	Ubuntu Local Security Checks	high
189611	Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6608-1)	Nessus	Ubuntu Local Security Checks	high
189610	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6609-1)	Nessus	Ubuntu Local Security Checks	high
189609	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6607-1)	Nessus	Ubuntu Local Security Checks	high
189474	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-046)	Nessus	Amazon Linux Local Security Checks	high
189471	Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-034)	Nessus	Amazon Linux Local Security Checks	high
189347	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-488)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2024-0193

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high