In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the values from the parent mount.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6895-1 advisory.

    It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition,     leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or     possibly execute arbitrary code. (CVE-2023-6270)

    It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer     dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service.
    (CVE-2024-0841)

    It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during     recursive action operations under certain conditions. A local attacker could use this to cause a denial of     service (system crash). (CVE-2024-1151)

    Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition,     leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a     denial of service (system crash). (CVE-2024-23307)

    Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a     race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause     a denial of service (system crash). (CVE-2024-24861)

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - PowerPC architecture;

    - x86 architecture;

    - Cryptographic API;

    - Android drivers;

    - Block layer subsystem;

    - Bluetooth drivers;

    - DMA engine subsystem;

    - GPU drivers;

    - HID subsystem;

    - Hardware monitoring drivers;

    - I2C subsystem;

    - IIO ADC drivers;

    - IIO subsystem;

    - IIO Magnetometer sensors drivers;

    - InfiniBand drivers;

    - On-Chip Interconnect management framework;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - PHY drivers;

    - MediaTek PM domains;

    - SCSI drivers;

    - TTY drivers;

    - USB subsystem;

    - DesignWare USB3 driver;

    - Framebuffer layer;

    - AFS file system;

    - BTRFS file system;

    - Ceph distributed file system;

    - Ext4 file system;

    - File systems infrastructure;

    - NILFS2 file system;

    - NTFS3 file system;

    - SMB network file system;

    - Core kernel;

    - Memory management;

    - Bluetooth subsystem;

    - CAN network layer;

    - Devlink API;

    - Handshake API;

    - HSR network protocol;

    - IPv4 networking;

    - IPv6 networking;

    - MAC80211 subsystem;

    - Multipath TCP;

    - Netfilter;

    - NFC subsystem;

    - RxRPC session sockets;

    - TIPC protocol;

    - Unix domain sockets;

    - Realtek audio codecs; (CVE-2024-26822, CVE-2024-26917, CVE-2024-26723, CVE-2024-26715, CVE-2024-26718,     CVE-2024-26664, CVE-2024-26707, CVE-2024-26697, CVE-2024-26720, CVE-2024-26660, CVE-2024-26677,     CVE-2024-26736, CVE-2024-26719, CVE-2024-26642, CVE-2024-26700, CVE-2024-26666, CVE-2024-26684,     CVE-2024-26803, CVE-2024-26698, CVE-2024-26711, CVE-2024-26922, CVE-2024-26828, CVE-2024-26910,     CVE-2024-26829, CVE-2024-26685, CVE-2024-26920, CVE-2024-26696, CVE-2024-26826, CVE-2023-52642,     CVE-2024-26703, CVE-2024-26708, CVE-2024-26838, CVE-2024-26716, CVE-2023-52631, CVE-2024-26782,     CVE-2024-26593, CVE-2024-26659, CVE-2024-26825, CVE-2024-26824, CVE-2024-26712, CVE-2024-26674,     CVE-2024-26722, CVE-2023-52643, CVE-2024-26714, CVE-2024-26691, CVE-2024-27416, CVE-2024-26830,     CVE-2023-52880, CVE-2024-26702, CVE-2023-52645, CVE-2024-26820, CVE-2024-26662, CVE-2024-26689,     CVE-2024-26676, CVE-2024-26923, CVE-2024-26603, CVE-2024-26818, CVE-2023-52638, CVE-2024-26733,     CVE-2024-26601, CVE-2024-26790, CVE-2024-26661, CVE-2024-26600, CVE-2024-26680, CVE-2024-26748,     CVE-2024-26792, CVE-2024-26889, CVE-2024-26681, CVE-2024-26688, CVE-2024-26665, CVE-2024-26602,     CVE-2024-26734, CVE-2024-35833, CVE-2024-26919, CVE-2024-26916, CVE-2024-26667, CVE-2024-26606,     CVE-2024-26693, CVE-2024-26717, CVE-2023-52637, CVE-2024-26831, CVE-2024-26663, CVE-2024-26694,     CVE-2024-26802, CVE-2024-26710, CVE-2024-26789, CVE-2024-26679, CVE-2024-26675, CVE-2024-26798,     CVE-2024-26695, CVE-2024-26726, CVE-2024-26926, CVE-2024-26735, CVE-2024-26898, CVE-2024-26890)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2362-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47247: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (bsc#1224865).
    - CVE-2021-47311: net: qcom/emac: fix UAF in emac_remove (bsc#1225010).
    - CVE-2021-47368: enetc: Fix illegal access when reading affinity_hint (bsc#1225161).
    - CVE-2021-47372: net: macb: fix use after free on rmmod (bsc#1225184).
    - CVE-2021-47379: blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (bsc#1225203).
    - CVE-2021-47571: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() (bsc#1225518).
    - CVE-2022-48760: USB: core: Fix hang in usb_kill_urb by adding memory barriers (bsc#1226712).
    - CVE-2023-52707: sched/psi: Fix use-after-free in ep_remove_wait_queue() (bsc#1225109). polled     (bsc#1202623).
    - CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225487).
    - CVE-2023-52881: tcp: do not accept ACK of bytes we never sent (bsc#1225611).
    - CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).
    - CVE-2024-35789: Check fast rx for non-4addr sta VLAN changes (bsc#1224749).
    - CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
    - CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
    - CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
    - CVE-2024-35950: drm/client: Fully protect modes with dev->mode_config.mutex (bsc#1224703).
    - CVE-2024-36894: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (bsc#1225749).
    - CVE-2024-36904: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique() (bsc#1225732).
    - CVE-2024-36940: pinctrl: core: delete incorrect free in pinctrl_enable() (bsc#1225840).
    - CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1225866).
    - CVE-2024-38545: RDMA/hns: Fix UAF for cq async event (bsc#1226595)
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758).
    - CVE-2024-38560: scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786).

    The following non-security bugs were fixed:

    - NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633 bsc#1226226).
    - ocfs2: adjust enabling place for la window (bsc#1219224).
    - ocfs2: fix sparse warnings (bsc#1219224).
    - ocfs2: improve write IO performance when fragmentation is high (bsc#1219224).
    - ocfs2: speed up chain-list searching (bsc#1219224).
    - psi: Fix uaf issue when psi trigger is destroyed while being
    - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs (bsc#1222015 bsc#1226962).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202291	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6895-1)	Nessus	Ubuntu Local Security Checks	high
202093	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2362-1)	Nessus	SuSE Local Security Checks	high
201009	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2190-1)	Nessus	SuSE Local Security Checks	critical
200853	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2135-1)	Nessus	SuSE Local Security Checks	high
200508	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2019-1)	Nessus	SuSE Local Security Checks	critical
200462	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2008-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2024-26822

medium

Tenable Plugins

high

high

critical

high

critical

critical