In the Linux kernel, the following vulnerability has been resolved: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() Syzbot reports a warning as follows: ============================================ WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mb_cache_destroy+0x224/0x290 Modules linked in: CPU: 0 PID: 5075 Comm: syz-executor199 Not tainted 6.9.0-rc6-gb947cc5bf6d7 RIP: 0010:mb_cache_destroy+0x224/0x290 fs/mbcache.c:419 Call Trace: <TASK> ext4_put_super+0x6d4/0xcd0 fs/ext4/super.c:1375 generic_shutdown_super+0x136/0x2d0 fs/super.c:641 kill_block_super+0x44/0x90 fs/super.c:1675 ext4_kill_sb+0x68/0xa0 fs/ext4/super.c:7327 [...] ============================================ This is because when finding an entry in ext4_xattr_block_cache_find(), if ext4_sb_bread() returns -ENOMEM, the ce's e_refcnt, which has already grown in the __entry_find(), won't be put away, and eventually trigger the above issue in mb_cache_destroy() due to reference count leakage. So call mb_cache_entry_put() on the -ENOMEM error branch as a quick fix.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6951-2 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - M68K architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Accessibility subsystem;

    - Character device driver;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - FireWire subsystem;

    - GPU drivers;

    - HW tracing;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Pin controllers subsystem;

    - S/390 drivers;

    - SCSI drivers;

    - SoundWire subsystem;

    - Greybus lights staging drivers;

    - TTY drivers;

    - Framebuffer layer;

    - Virtio drivers;

    - 9P distributed file system;

    - eCrypt file system;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - Network file system client;

    - NILFS2 file system;

    - SMB network file system;

    - Kernel debugger infrastructure;

    - IRQ subsystem;

    - Tracing infrastructure;

    - Dynamic debug library;

    - 9P file system network protocol;

    - Bluetooth subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - NSH protocol;

    - Open vSwitch;

    - Phonet protocol;

    - TIPC protocol;

    - Unix domain sockets;

    - Wireless networking;

    - eXpress Data Path;

    - XFRM subsystem;

    - ALSA framework; (CVE-2024-36934, CVE-2024-38578, CVE-2024-38600, CVE-2024-27399, CVE-2024-39276,     CVE-2024-38596, CVE-2024-36933, CVE-2024-36919, CVE-2024-35976, CVE-2024-37356, CVE-2023-52585,     CVE-2024-38558, CVE-2024-38560, CVE-2024-38634, CVE-2024-36959, CVE-2024-38633, CVE-2024-36886,     CVE-2024-27398, CVE-2024-39493, CVE-2024-26886, CVE-2024-31076, CVE-2024-38559, CVE-2024-38615,     CVE-2024-36971, CVE-2024-38627, CVE-2024-36964, CVE-2024-38780, CVE-2024-37353, CVE-2024-38621,     CVE-2024-36883, CVE-2024-39488, CVE-2024-38661, CVE-2024-36939, CVE-2024-38589, CVE-2024-38565,     CVE-2024-38381, CVE-2024-35947, CVE-2024-36905, CVE-2022-48772, CVE-2024-36017, CVE-2024-36946,     CVE-2024-27401, CVE-2024-38579, CVE-2024-38612, CVE-2024-38598, CVE-2024-38635, CVE-2024-38587,     CVE-2024-38567, CVE-2024-38549, CVE-2024-36960, CVE-2023-52752, CVE-2024-27019, CVE-2024-38601,     CVE-2024-39489, CVE-2024-39467, CVE-2023-52882, CVE-2024-38583, CVE-2024-39480, CVE-2024-38607,     CVE-2024-36940, CVE-2024-38659, CVE-2023-52434, CVE-2024-36015, CVE-2024-38582, CVE-2024-36950,     CVE-2024-38552, CVE-2024-33621, CVE-2024-36954, CVE-2024-39475, CVE-2024-39301, CVE-2024-38599,     CVE-2024-36902, CVE-2024-36286, CVE-2024-38613, CVE-2024-38637, CVE-2024-36941, CVE-2024-36014,     CVE-2024-38618, CVE-2024-36904, CVE-2024-36270, CVE-2024-39292, CVE-2024-39471, CVE-2022-48674)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12581 advisory.

    - net/mlx5e: drop shorter ethernet frames (Manjunath Patil)  [Orabug: 36879157]  {CVE-2024-41090}     {CVE-2024-41091}
    - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Jozsef Kadlecsik)     [Orabug: 36835599] {CVE-2024-39503}
    - drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found (Marek Szyprowski) [Orabug:
    36836328] {CVE-2024-40916}
    - s390/ap: Fix crash in AP internal function modify_bitmap() (Harald Freudenberger) [Orabug: 36774592]     {CVE-2024-38661}
    - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Baokun Li) [Orabug: 36774598]     {CVE-2024-39276}
    - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (Eric Dumazet) [Orabug: 36643449]     {CVE-2024-35976}
    - net: fix __dst_negative_advice() race (Eric Dumazet) [Orabug: 36720417] {CVE-2024-36971}
    - kdb: Use format-strings rather than '- kdb: Fix buffer overflow during tab-complete (Daniel Thompson)     [Orabug: 36809288] {CVE-2024-39480}
    - net/9p: fix uninit-value in p9_client_rpc() (Nikita Zhandarovich) [Orabug: 36774612] {CVE-2024-39301}
    - drm/amdgpu: add error handle to avoid out-of-bounds (Bob Zhou) [Orabug: 36774657] {CVE-2024-39471}
    - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() (Chao Yu) [Orabug: 36774636]     {CVE-2024-39467}
    - nilfs2: fix use-after-free of timer for log writer thread (Ryusuke Konishi) [Orabug: 36753564]     {CVE-2024-38583}
    - SUNRPC: Fix loop termination condition in gss_free_in_token_pages() (Chuck Lever) [Orabug: 36809512]     {CVE-2024-36288}
    - ALSA: timer: Set lower bound of start tick time (Takashi Iwai) [Orabug: 36753729] {CVE-2024-38618}
    - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Yue Haibing) [Orabug: 36763551]     {CVE-2024-33621}
    - netfilter: tproxy: bail out if IP has been disabled on the device (Florian Westphal) [Orabug: 36763563]     {CVE-2024-36270}
    - enic: Validate length of nl attributes in enic_set_vf_port (Roded Zats) [Orabug: 36763836]     {CVE-2024-38659}
    - dma-buf/sw-sync: don't enable IRQ from sync_print_obj() (Tetsuo Handa) [Orabug: 36763844]     {CVE-2024-38780}
    - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Eric Dumazet) [Orabug:
    36763570] {CVE-2024-36286}
    - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails (Jiri Pirko) [Orabug: 36763587]     {CVE-2024-37353}
    - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY (Jiangfeng Xiao) [Orabug: 36825258]     {CVE-2024-39488}
    - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (Kuniyuki Iwashima) [Orabug: 36763591]     {CVE-2024-37356}
    - ipv6: sr: fix memleak in seg6_hmac_init_algo (Hangbin Liu) [Orabug: 36825262] {CVE-2024-39489}
    - media: stk1160: fix bounds checking in stk1160_copy_video() (Dan Carpenter) [Orabug: 36763602]     {CVE-2024-38621}
    - um: Add winch to winch_handlers before registering winch IRQ (Roberto Sassu) [Orabug: 36768583]     {CVE-2024-39292}
    - ppdev: Add an error check in register_device (Huai-Yuan Liu) [Orabug: 36678064] {CVE-2024-36015}
    - stm class: Fix a double free in stm_register_device() (Dan Carpenter) [Orabug: 36763763]     {CVE-2024-38627}
    - serial: max3100: Update uart_driver_registered on driver removal (Andy Shevchenko) [Orabug: 36763814]     {CVE-2024-38633}
    - serial: max3100: Lock port->lock when calling uart_handle_cts_change() (Andy Shevchenko) [Orabug:
    36763819] {CVE-2024-38634}
    - soundwire: cadence: fix invalid PDI offset (Pierre-Louis Bossart) [Orabug: 36763825] {CVE-2024-38635}
    - greybus: lights: check return of get_channel_from_mode (Rui Miguel Silva) [Orabug: 36763832]     {CVE-2024-38637}
    - netrom: fix possible dead-lock in nr_rt_ioctl() (Eric Dumazet) [Orabug: 36753581] {CVE-2024-38589}
    - drm/arm/malidp: fix a possible null pointer dereference (Huai-Yuan Liu) [Orabug: 36678061]     {CVE-2024-36014}
    - drm/mediatek: Add 0 size check to mtk_drm_gem_obj (Justin Green) [Orabug: 36753414] {CVE-2024-38549}
    - drm/amd/display: Fix potential index out of bounds in color transformation function (Srinivasan     Shanmugam) [Orabug: 36753424] {CVE-2024-38552}
    - ipv6: sr: fix invalid unregister error path (Hangbin Liu) [Orabug: 36753710] {CVE-2024-38612}
    - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (Ilya Maximets) [Orabug: 36753462]     {CVE-2024-38558}
    - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Breno Leitao) [Orabug: 36753599]     {CVE-2024-38596}
    - m68k: Fix spinlock race in kernel thread creation (Michael Schmitz) [Orabug: 36753714] {CVE-2024-38613}
    - scsi: qedf: Ensure the copied buf is NUL terminated (Bui Quang Minh) [Orabug: 36753467] {CVE-2024-38559}
    - scsi: bfa: Ensure the copied buf is NUL terminated (Bui Quang Minh) [Orabug: 36753472] {CVE-2024-38560}
    - wifi: ar5523: enable proper endpoint verification (Nikita Zhandarovich) [Orabug: 36753485]     {CVE-2024-38565}
    - wifi: carl9170: add a proper sanity check for endpoints (Nikita Zhandarovich) [Orabug: 36753508]     {CVE-2024-38567}
    - cpufreq: exit() callback is optional (Viresh Kumar) [Orabug: 36753721] {CVE-2024-38615}
    - md: fix resync softlockup when bitmap size is less than array size (Yu Kuai) [Orabug: 36753648]     {CVE-2024-38598}
    - jffs2: prevent xattr node from overflowing the eraseblock (Ilya Denisyev) [Orabug: 36753651]     {CVE-2024-38599}
    - ecryptfs: Fix buffer size for tag 66 packet (Brian Kubisiak) [Orabug: 36753536] {CVE-2024-38578}
    - crypto: bcm - Fix pointer arithmetic (Aleksandr Mishin) [Orabug: 36753541] {CVE-2024-38579}
    - nilfs2: fix potential hang in nilfs_detach_log_writer() (Ryusuke Konishi) [Orabug: 36753557]     {CVE-2024-38582}
    - ring-buffer: Fix a race between readers and resize checks (Petr Pavlu) [Orabug: 36753661]     {CVE-2024-38601}
    - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Daniel Starke) [Orabug: 36678068]     {CVE-2024-36016}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12585 advisory.

    - net/mlx5e: drop shorter ethernet frames (Manjunath Patil)  [Orabug: 36879157]  {CVE-2024-41090}     {CVE-2024-41091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12584 advisory.

    - net/mlx5e: drop shorter ethernet frames (Manjunath Patil)  [Orabug: 36879157]  {CVE-2024-41090}     {CVE-2024-41091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5102 advisory.

    * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
    * kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
    * kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
    * kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
    * kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
    * kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
    * kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
    * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
    * kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
    * kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by     untrusted application (CVE-2024-21823)
    * kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
    * kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
    * kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
    * kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
    * kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
    * kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
    * kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
    * kernel: Revert net/mlx5: Block entering switchdev mode with ns inconsistency (CVE-2023-52658)
    * kernel: crash due to a missing check for leb_size (CVE-2024-25739)
    * kernel: tcp: make sure init the accept_queue's spinlocks once (CVE-2024-26614)
    * kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)
    * kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870)
    * kernel: nfs: fix UAF in direct writes (CVE-2024-26958)
    * kernel: SUNRPC: fix some memleaks in gssx_dec_option_array (CVE-2024-27388)
    * kernel: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (CVE-2024-27434)
    * kernel: of: Fix double free in of_parse_phandle_with_args_map (CVE-2023-52679)
    * kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (CVE-2024-35930)
    * kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks (CVE-2024-35912)
    * kernel: block: prevent division by zero in blk_rq_stat_sum() (CVE-2024-35925)
    * kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB (CVE-2024-35938)
    * kernel: wifi: cfg80211: check A-MSDU format more carefully (CVE-2024-35937)
    * kernel: wifi: rtw89: fix null pointer access when abort scan (CVE-2024-35946)
    * kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005)
    * kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)
    * kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (CVE-2024-36006)
    * kernel: net: ieee802154: fix null deref in parse dev addr (CVE-2021-47257)
    * kernel: mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)
    * kernel: wifi: ath11k: fix gtk offload status event locking (CVE-2023-52777)
    * (CVE-2023-52832)
    * (CVE-2023-52803)
    * (CVE-2023-52756)
    * (CVE-2023-52834)
    * (CVE-2023-52791)
    * (CVE-2023-52764)
    * (CVE-2021-47468)
    * (CVE-2021-47284)
    * (CVE-2024-36025)
    * (CVE-2024-36941)
    * (CVE-2024-36940)
    * (CVE-2024-36904)
    * (CVE-2024-36896)
    * (CVE-2024-36954)
    * (CVE-2024-36950)
    * (CVE-2024-38575)
    * (CVE-2024-36917)
    * (CVE-2024-36016)
    * (CVE-2023-52762)
    * (CVE-2024-27025)
    * (CVE-2021-47548)
    * (CVE-2023-52619)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5101 advisory.

    * kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)
    * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
    * kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)
    * kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)
    * kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)
    * kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)
    * kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)
    * kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
    * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)
    * kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)
    * kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by     untrusted application (CVE-2024-21823)
    * kernel: Revert net/mlx5: Block entering switchdev mode with ns inconsistency (CVE-2023-52658)
    * kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)
    * kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)
    * kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)
    * kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)
    * kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)
    * kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)
    * kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)
    * (CVE-2023-28746)
    * (CVE-2023-52847)
    * (CVE-2021-47548)
    * (CVE-2024-36921)
    * (CVE-2024-26921)
    * (CVE-2021-47579)
    * (CVE-2024-36927)
    * (CVE-2024-39276)
    * (CVE-2024-33621)
    * (CVE-2024-27010)
    * (CVE-2024-26960)
    * (CVE-2024-38596)
    * (CVE-2022-48743)
    * (CVE-2024-26733)
    * (CVE-2024-26586)
    * (CVE-2024-26698)
    * (CVE-2023-52619)

    Bug Fix(es):

    * AlmaLinux8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output     (JIRA:AlmaLinux-17678)
    * [AWS][8.9]There are call traces found when booting debug-kernel  for Amazon EC2 r8g.metal-24xl instance     (JIRA:AlmaLinux-23841)
    * [almalinux8] gfs2: Fix glock shrinker (JIRA:AlmaLinux-32941)
    * lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:AlmaLinux-33437)
    * [Hyper-V][AlmaLinux-8.10.z] Update hv_netvsc driver to TOT (JIRA:AlmaLinux-39074)
    * Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:AlmaLinux-40167)
    * blk-cgroup: Properly propagate the iostat update up the hierarchy [almalinux-8.10.z]     (JIRA:AlmaLinux-40939)
    * (JIRA:AlmaLinux-31798)
    * (JIRA:AlmaLinux-10263)
    * (JIRA:AlmaLinux-40901)
    * (JIRA:AlmaLinux-43547)
    * (JIRA:AlmaLinux-34876)

    Enhancement(s):

    * [RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog     configuration (JIRA:AlmaLinux-19723)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6953-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - M68K architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Accessibility subsystem;

    - Character device driver;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - FireWire subsystem;

    - ARM SCMI message protocol;

    - GPU drivers;

    - HW tracing;

    - InfiniBand drivers;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Pin controllers subsystem;

    - S/390 drivers;

    - SCSI drivers;

    - SoundWire subsystem;

    - Greybus lights staging drivers;

    - TTY drivers;

    - Framebuffer layer;

    - Virtio drivers;

    - 9P distributed file system;

    - eCrypt file system;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - Network file system client;

    - NILFS2 file system;

    - SMB network file system;

    - Mellanox drivers;

    - Kernel debugger infrastructure;

    - IRQ subsystem;

    - Tracing infrastructure;

    - Dynamic debug library;

    - 9P file system network protocol;

    - Bluetooth subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - NSH protocol;

    - Open vSwitch;

    - Phonet protocol;

    - TIPC protocol;

    - TLS protocol;

    - Unix domain sockets;

    - Wireless networking;

    - eXpress Data Path;

    - XFRM subsystem;

    - ALSA framework; (CVE-2024-26584, CVE-2023-52434, CVE-2024-36933, CVE-2024-36286, CVE-2024-36886,     CVE-2024-38579, CVE-2022-48772, CVE-2024-39493, CVE-2024-38637, CVE-2024-36016, CVE-2023-52752,     CVE-2024-38558, CVE-2024-39488, CVE-2024-38559, CVE-2024-36919, CVE-2024-36905, CVE-2024-39489,     CVE-2024-39475, CVE-2021-47131, CVE-2024-26585, CVE-2024-38578, CVE-2024-38567, CVE-2024-38596,     CVE-2024-38598, CVE-2024-36940, CVE-2024-38552, CVE-2024-37356, CVE-2024-38780, CVE-2024-38589,     CVE-2024-36959, CVE-2024-27399, CVE-2024-36017, CVE-2024-38661, CVE-2024-36939, CVE-2024-36904,     CVE-2024-36902, CVE-2024-38381, CVE-2024-36883, CVE-2024-37353, CVE-2024-38560, CVE-2024-39292,     CVE-2024-36934, CVE-2024-38621, CVE-2024-38599, CVE-2024-36941, CVE-2022-48655, CVE-2024-26886,     CVE-2024-36014, CVE-2024-38613, CVE-2024-27398, CVE-2024-27019, CVE-2024-36954, CVE-2024-39471,     CVE-2024-26583, CVE-2024-35947, CVE-2024-31076, CVE-2024-38659, CVE-2024-38549, CVE-2024-38618,     CVE-2024-38565, CVE-2024-27401, CVE-2022-48674, CVE-2024-38582, CVE-2024-38634, CVE-2024-38627,     CVE-2024-39480, CVE-2024-36015, CVE-2023-52585, CVE-2024-36270, CVE-2024-26907, CVE-2024-38615,     CVE-2024-38600, CVE-2024-38612, CVE-2024-36946, CVE-2024-39301, CVE-2024-38601, CVE-2024-38635,     CVE-2024-33621, CVE-2024-36964, CVE-2024-38633, CVE-2024-39467, CVE-2024-38607, CVE-2024-36971,     CVE-2024-35976, CVE-2024-38587, CVE-2023-52882, CVE-2024-36950, CVE-2024-39276, CVE-2024-36960,     CVE-2024-38583)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6951-1 advisory.

    Several security issues were discovered in the Linux kernel. An attacker could possibly use these to     compromise the system. This update corrects flaws in the following subsystems:

    - ARM64 architecture;

    - M68K architecture;

    - User-Mode Linux (UML);

    - x86 architecture;

    - Accessibility subsystem;

    - Character device driver;

    - Clock framework and drivers;

    - CPU frequency scaling framework;

    - Hardware crypto device drivers;

    - Buffer Sharing and Synchronization framework;

    - FireWire subsystem;

    - GPU drivers;

    - HW tracing;

    - Macintosh device drivers;

    - Multiple devices driver;

    - Media drivers;

    - Network drivers;

    - Pin controllers subsystem;

    - S/390 drivers;

    - SCSI drivers;

    - SoundWire subsystem;

    - Greybus lights staging drivers;

    - TTY drivers;

    - Framebuffer layer;

    - Virtio drivers;

    - 9P distributed file system;

    - eCrypt file system;

    - EROFS file system;

    - Ext4 file system;

    - F2FS file system;

    - JFFS2 file system;

    - Network file system client;

    - NILFS2 file system;

    - SMB network file system;

    - Kernel debugger infrastructure;

    - IRQ subsystem;

    - Tracing infrastructure;

    - Dynamic debug library;

    - 9P file system network protocol;

    - Bluetooth subsystem;

    - Networking core;

    - IPv4 networking;

    - IPv6 networking;

    - Netfilter;

    - NET/ROM layer;

    - NFC subsystem;

    - NSH protocol;

    - Open vSwitch;

    - Phonet protocol;

    - TIPC protocol;

    - Unix domain sockets;

    - Wireless networking;

    - eXpress Data Path;

    - XFRM subsystem;

    - ALSA framework; (CVE-2024-36934, CVE-2024-38578, CVE-2024-38600, CVE-2024-27399, CVE-2024-39276,     CVE-2024-38596, CVE-2024-36933, CVE-2024-36919, CVE-2024-35976, CVE-2024-37356, CVE-2023-52585,     CVE-2024-38558, CVE-2024-38560, CVE-2024-38634, CVE-2024-36959, CVE-2024-38633, CVE-2024-36886,     CVE-2024-27398, CVE-2024-39493, CVE-2024-26886, CVE-2024-31076, CVE-2024-38559, CVE-2024-38615,     CVE-2024-36971, CVE-2024-38627, CVE-2024-36964, CVE-2024-38780, CVE-2024-37353, CVE-2024-38621,     CVE-2024-36883, CVE-2024-39488, CVE-2024-38661, CVE-2024-36939, CVE-2024-38589, CVE-2024-38565,     CVE-2024-38381, CVE-2024-35947, CVE-2024-36905, CVE-2022-48772, CVE-2024-36017, CVE-2024-36946,     CVE-2024-27401, CVE-2024-38579, CVE-2024-38612, CVE-2024-38598, CVE-2024-38635, CVE-2024-38587,     CVE-2024-38567, CVE-2024-38549, CVE-2024-36960, CVE-2023-52752, CVE-2024-27019, CVE-2024-38601,     CVE-2024-39489, CVE-2024-39467, CVE-2023-52882, CVE-2024-38583, CVE-2024-39480, CVE-2024-38607,     CVE-2024-36940, CVE-2024-38659, CVE-2023-52434, CVE-2024-36015, CVE-2024-38582, CVE-2024-36950,     CVE-2024-38552, CVE-2024-33621, CVE-2024-36954, CVE-2024-39475, CVE-2024-39301, CVE-2024-38599,     CVE-2024-36902, CVE-2024-36286, CVE-2024-38613, CVE-2024-38637, CVE-2024-36941, CVE-2024-36014,     CVE-2024-38618, CVE-2024-36904, CVE-2024-36270, CVE-2024-39292, CVE-2024-39471, CVE-2022-48674)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5101 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451)

    * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)

    * kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    * kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)

    * kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)

    * kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)

    * kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)

    * kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)

    * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)

    * kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)

    * kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by     untrusted application (CVE-2024-21823)

    * kernel: Revert net/mlx5: Block entering switchdev mode with ns inconsistency (CVE-2023-52658)

    * kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)

    * kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)

    * kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)

    * kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)

    * kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)

    * kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)

    * kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)

    * (CVE-2023-28746)
    * (CVE-2023-52847)
    * (CVE-2021-47548)
    * (CVE-2024-36921)
    * (CVE-2024-26921)
    * (CVE-2021-47579)
    * (CVE-2024-36927)
    * (CVE-2024-39276)
    * (CVE-2024-33621)
    * (CVE-2024-27010)
    * (CVE-2024-26960)
    * (CVE-2024-38596)
    * (CVE-2022-48743)
    * (CVE-2024-26733)
    * (CVE-2024-26586)
    * (CVE-2024-26698)
    * (CVE-2023-52619)

    Bug Fix(es):

    * RHEL8.6 - Spinlock statistics may show negative elapsed time and incorrectly formatted output     (JIRA:RHEL-17678)

    * [AWS][8.9]There are call traces found when booting debug-kernel  for Amazon EC2 r8g.metal-24xl instance     (JIRA:RHEL-23841)

    * [rhel8] gfs2: Fix glock shrinker (JIRA:RHEL-32941)

    * lan78xx: Microchip LAN7800 never comes up after unplug and replug (JIRA:RHEL-33437)

    * [Hyper-V][RHEL-8.10.z] Update hv_netvsc driver to TOT (JIRA:RHEL-39074)

    * Use-after-free on proc inode-i_sb triggered by fsnotify (JIRA:RHEL-40167)

    * blk-cgroup: Properly propagate the iostat update up the hierarchy [rhel-8.10.z] (JIRA:RHEL-40939)

    * (JIRA:RHEL-31798)
    * (JIRA:RHEL-10263)
    * (JIRA:RHEL-40901)
    * (JIRA:RHEL-43547)
    * (JIRA:RHEL-34876)

    Enhancement(s):

    * [RFE] Add module parameters 'soft_reboot_cmd' and 'soft_active_on_boot' for customizing softdog     configuration (JIRA:RHEL-19723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5102 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)

    * kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    * kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622)

    * kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669)

    * kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802)

    * kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843)

    * kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)

    * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)

    * kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653)

    * kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by     untrusted application (CVE-2024-21823)

    * kernel: ext4: fix corruption during on-line resize (CVE-2024-35807)

    * kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801)

    * kernel: dyndbg: fix old BUG_ON in >control parser (CVE-2024-35947)

    * kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893)

    * kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (CVE-2024-35876)

    * kernel: platform/x86: wmi: Fix opening of char device (CVE-2023-52864)

    * kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (CVE-2023-52845)

    * kernel: Revert net/mlx5: Block entering switchdev mode with ns inconsistency (CVE-2023-52658)

    * kernel: crash due to a missing check for leb_size (CVE-2024-25739)

    * kernel: tcp: make sure init the accept_queue's spinlocks once (CVE-2024-26614)

    * kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640)

    * kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870)

    * kernel: nfs: fix UAF in direct writes (CVE-2024-26958)

    * kernel: SUNRPC: fix some memleaks in gssx_dec_option_array (CVE-2024-27388)

    * kernel: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (CVE-2024-27434)

    * kernel: of: Fix double free in of_parse_phandle_with_args_map (CVE-2023-52679)

    * kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (CVE-2024-35930)

    * kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks (CVE-2024-35912)

    * kernel: block: prevent division by zero in blk_rq_stat_sum() (CVE-2024-35925)

    * kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB (CVE-2024-35938)

    * kernel: wifi: cfg80211: check A-MSDU format more carefully (CVE-2024-35937)

    * kernel: wifi: rtw89: fix null pointer access when abort scan (CVE-2024-35946)

    * kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005)

    * kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)

    * kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (CVE-2024-36006)

    * kernel: net: ieee802154: fix null deref in parse dev addr (CVE-2021-47257)

    * kernel: mmc: sdio: fix possible resource leaks in some error paths (CVE-2023-52730)

    * kernel: wifi: ath11k: fix gtk offload status event locking (CVE-2023-52777)

    * (CVE-2023-52832)
    * (CVE-2023-52803)
    * (CVE-2023-52756)
    * (CVE-2023-52834)
    * (CVE-2023-52791)
    * (CVE-2023-52764)
    * (CVE-2021-47468)
    * (CVE-2021-47284)
    * (CVE-2024-36025)
    * (CVE-2024-36941)
    * (CVE-2024-36940)
    * (CVE-2024-36904)
    * (CVE-2024-36896)
    * (CVE-2024-36954)
    * (CVE-2024-36950)
    * (CVE-2024-38575)
    * (CVE-2024-36917)
    * (CVE-2024-36016)
    * (CVE-2023-52762)
    * (CVE-2024-27025)
    * (CVE-2021-47548)
    * (CVE-2023-52619)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5730 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5730-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 15, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2022-43945 CVE-2022-48772 CVE-2024-25741 CVE-2024-26629                      CVE-2024-27019 CVE-2024-31076 CVE-2024-33621 CVE-2024-33847                      CVE-2024-34027 CVE-2024-35247 CVE-2024-36014 CVE-2024-36015                      CVE-2024-36016 CVE-2024-36270 CVE-2024-36286 CVE-2024-36288                      CVE-2024-36489 CVE-2024-36894 CVE-2024-36971 CVE-2024-36974                      CVE-2024-36978 CVE-2024-37078 CVE-2024-37353 CVE-2024-37356                      CVE-2024-38381 CVE-2024-38546 CVE-2024-38547 CVE-2024-38548                      CVE-2024-38549 CVE-2024-38552 CVE-2024-38555 CVE-2024-38558                      CVE-2024-38559 CVE-2024-38560 CVE-2024-38565 CVE-2024-38567                      CVE-2024-38578 CVE-2024-38579 CVE-2024-38582 CVE-2024-38583                      CVE-2024-38586 CVE-2024-38587 CVE-2024-38589 CVE-2024-38590                      CVE-2024-38596 CVE-2024-38597 CVE-2024-38598 CVE-2024-38599                      CVE-2024-38601 CVE-2024-38605 CVE-2024-38607 CVE-2024-38612                      CVE-2024-38613 CVE-2024-38615 CVE-2024-38618 CVE-2024-38619                      CVE-2024-38621 CVE-2024-38627 CVE-2024-38633 CVE-2024-38634                      CVE-2024-38635 CVE-2024-38637 CVE-2024-38659 CVE-2024-38661                      CVE-2024-38662 CVE-2024-38780 CVE-2024-39276 CVE-2024-39292                      CVE-2024-39301 CVE-2024-39467 CVE-2024-39468 CVE-2024-39469                      CVE-2024-39471 CVE-2024-39475 CVE-2024-39476 CVE-2024-39480                      CVE-2024-39482 CVE-2024-39484 CVE-2024-39488 CVE-2024-39489                      CVE-2024-39493 CVE-2024-39495 CVE-2024-39499 CVE-2024-39501                      CVE-2024-39502 CVE-2024-39503 CVE-2024-39505 CVE-2024-39506                      CVE-2024-39509 CVE-2024-40901 CVE-2024-40902 CVE-2024-40904                      CVE-2024-40905 CVE-2024-40912 CVE-2024-40916 CVE-2024-40929                      CVE-2024-40931 CVE-2024-40932 CVE-2024-40934 CVE-2024-40941                      CVE-2024-40942 CVE-2024-40943 CVE-2024-40945 CVE-2024-40958                      CVE-2024-40959 CVE-2024-40960 CVE-2024-40961 CVE-2024-40963                      CVE-2024-40968 CVE-2024-40971 CVE-2024-40974 CVE-2024-40976                      CVE-2024-40978 CVE-2024-40980 CVE-2024-40981 CVE-2024-40983                      CVE-2024-40984 CVE-2024-40987 CVE-2024-40988 CVE-2024-40990                      CVE-2024-40993 CVE-2024-40995 CVE-2024-41000 CVE-2024-41004                      CVE-2024-41005 CVE-2024-41006

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 5.10.221-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205550	Ubuntu 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-6951-2)	Nessus	Ubuntu Local Security Checks	high
205493	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2894-1)	Nessus	SuSE Local Security Checks	high
205492	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2896-1)	Nessus	SuSE Local Security Checks	high
205422	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2024-12581)	Nessus	Oracle Linux Local Security Checks	high
205420	Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2024-12585)	Nessus	Oracle Linux Local Security Checks	high
205419	Oracle Linux 8 : Unbreakable Enterprise kernel-container (ELSA-2024-12584)	Nessus	Oracle Linux Local Security Checks	high
205332	Oracle Linux 8 : kernel (ELSA-2024-5101)	Nessus	Oracle Linux Local Security Checks	high
205294	AlmaLinux 8 : kernel-rt (ALSA-2024:5102)	Nessus	Alma Linux Local Security Checks	high
205293	AlmaLinux 8 : kernel (ALSA-2024:5101)	Nessus	Alma Linux Local Security Checks	high
205288	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-6953-1)	Nessus	Ubuntu Local Security Checks	high
205223	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6951-1)	Nessus	Ubuntu Local Security Checks	high
205214	RHEL 8 : kernel (RHSA-2024:5101)	Nessus	Red Hat Local Security Checks	high
205212	RHEL 8 : kernel-rt (RHSA-2024:5102)	Nessus	Red Hat Local Security Checks	high
205163	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2802-1)	Nessus	SuSE Local Security Checks	high
202458	Debian dsa-5730 : affs-modules-5.10.0-29-4kc-malta-di - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-39276

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high