In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur. A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state. Taking advantage of previous patches in this series we move a number of checks earlier in the code, simplifying things by moving the core of the logic into a static internal function __mmap_region(). Doing this allows us to perform a number of checks up front before we do any real work, and allows us to unwind the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE validation unconditionally also. We move a number of things here: 1. We preallocate memory for the iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform complicated and error-prone close/free logic. We carefully free iterator state on both success and error paths. 2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a matching mapping_unmap_writable() on success and error paths. We now do this unconditionally if this is a file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however doing so does not invalidate the seal check we just performed, and we in any case always decrement the counter in the wrapper. We perform a debug assert to ensure a driver does not attempt to do the opposite. 3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64 and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate the need for this. With all of these measures in place, we no longer need to explicitly close the VMA on error paths, as we place all checks which might fail prior to a call to any driver mmap hook. This eliminates an entire class of errors, makes the code easier to reason about and more robust.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    bpf: sync_linked_regs() must preserve subreg_def(CVE-2024-53125)

    nvme-multipath: defer partition scanning(CVE-2024-53093)

    dm cache: fix flushing uninitialized delayed_work on cache_ctr error(CVE-2024-50280)

    net: fix data-races around sk-sk_forward_alloc(CVE-2024-53124)

    NFSD: Never decrement pending_async_copies on error(CVE-2024-53073)

    smb: client: Fix use-after-free of network namespace.(CVE-2024-53095)

    mm: resolve faulty mmap_region() error path behaviour(CVE-2024-53096)

    media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format(CVE-2024-53104)

    arm64: probes: Fix uprobes for big-endian kernels(CVE-2024-50194)

    HID: core: zero-initialize the report buffer(CVE-2024-50302)

    ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find().(CVE-2024-50304)

    i40e: fix race condition by adding filter's intermediate sync state(CVE-2024-53088)

    media: dvbdev: prevent the risk of out of memory access(CVE-2024-53063)

    dm cache: fix potential out-of-bounds access on the first resume(CVE-2024-50278)

    dm cache: fix out-of-bounds access to the dirty bitset when resizing(CVE-2024-50279)

    net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT(CVE-2024-53057)

    usb: typec: altmode should keep reference to parent(CVE-2024-50150)

    vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans(CVE-2024-50264)

    USB: serial: io_edgeport: fix use after free in debug printk(CVE-2024-50267)

    filemap: Fix bounds checking in filemap_read().(CVE-2024-50272)

    sctp: properly validate chunk size in sctp_sf_ootb().(CVE-2024-50299)

    bpf: Check validity of link-type in bpf_link_show_fdinfo().(CVE-2024-53099)

    media: av7110: fix a spectre vulnerability(CVE-2024-50289)

    RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages(CVE-2024-50208)

    security/keys: fix slab-out-of-bounds in key_task_permission(CVE-2024-50301)

    KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory(CVE-2024-50115)

    nfs: Fix KMSAN warning in decode_getfattr_attrs().(CVE-2024-53066)

    net: missing check virtio(CVE-2024-43817)

    io_uring/rw: fix missing NOWAIT check for O_DIRECT start write(CVE-2024-53052)

    An issue was discovered in the Linux kernel before 5.11.11. The BPF subsystem does not properly consider     that resolved_ids and resolved_sizes are intentionally uninitialized in the vmlinux BPF Type Format (BTF),     which can cause a system crash upon an unexpected access attempt (in map_create in kernel/bpf/syscall.c or     check_btf_info in kernel/bpf/verifier.c), aka CID-350a5c4dd245.(CVE-2021-29648)

    sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start(CVE-2024-49944)

    be2net: fix potential memory leak in be_xmit().(CVE-2024-50167)

    netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6().(CVE-2024-50256)

    netfilter: nft_payload: sanitize offset and length before calling skb_checksum().(CVE-2024-50251)

    net: hns3: fix kernel crash when uninstalling driver(CVE-2024-50296)

    tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().(CVE-2024-50154)

    net: fix crash when config small gso_max_size/gso_ipv4_max_size(CVE-2024-50258)

    RDMA/bnxt_re: Add a check for memory allocation(CVE-2024-50209)

    netfilter: nf_tables: prevent nf_skb_duplicated corruption(CVE-2024-49952)

    udf: fix uninit-value use in udf_get_fileshortad(CVE-2024-50143)

    bpf: Fix out-of-bounds write in trie_get_next_key().(CVE-2024-50262)

    tpm: Lock TPM chip in tpm_pm_suspend() first(CVE-2024-53085)

    bpf: support non-r10 register spill/fill to/from stack in precision tracking(CVE-2023-52920)

    bpf, arm64: Fix address emission with tag-based KASAN enabled(CVE-2024-50203)

    mm/swapfile: skip HugeTLB pages for unuse_vma(CVE-2024-50199)

    secretmem: disable memfd_secret() if arch cannot set direct map(CVE-2024-50182)

    NFSD: Initialize struct nfsd4_copy earlier(CVE-2024-50241)

    nvme-pci: fix race condition between reset and nvme_dev_disable().(CVE-2024-50135)

    irqchip/gic-v4: Don't allow a VMOVP on a dying VPE(CVE-2024-50192)

    bpf: Use raw_spinlock_t in ringbuf(CVE-2024-50138)

    x86/sgx: Fix deadlock in SGX NUMA node search(CVE-2024-49856)

    KVM: x86: Acquire kvm-srcu when handling KVM_SET_VCPU_EVENTS(CVE-2024-46830)

    RDMA/mad: Improve handling of timed out WRs of mad agent(CVE-2024-50095)

    ceph: remove the incorrect Fw reference check when dirtying pages(CVE-2024-50179)

    kernel: Fix page corruption caused by racy check in __free_pages(CVE-2023-52739)

    xfrm: validate new SA's prefixlen using SA family when sel.family is unset(CVE-2024-50142)

    posix-clock: Fix missing timespec64 check in pc_clock_settime().(CVE-2024-50195)

    iommu/vt-d: Fix double list_add when enabling VMD in scalable mode(CVE-2022-48916)

    static_call: Replace pointless WARN_ON() in static_call_module_notify().(CVE-2024-49954)

    tracing: Consider the NULL character when validating the event length(CVE-2024-50131)

    tty: n_gsm: Fix use-after-free in gsm_cleanup_mux(CVE-2024-50073)

    arm64: probes: Remove broken LDR (literal) uprobe support(CVE-2024-50099)

    net: add more sanity checks to qdisc_pkt_len_init().(CVE-2024-49948)

    net: avoid potential underflow in qdisc_pkt_len_init() with UFO(CVE-2024-49949)

    l2tp: prevent possible tunnel refcount underflow(CVE-2024-49940)

    RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency(CVE-2024-47696)

    smb: client: fix OOBs when building SMB2_IOCTL request(CVE-2024-50151)

    platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug(CVE-2024-49886)

    resource: fix region_intersects() vs add_memory_driver_managed().(CVE-2024-49878)

    sched: Fix yet more sched_fork() races(CVE-2022-48944)

    sched/fair: Fix fault in reweight_entity(CVE-2022-48921)

    fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name(CVE-2024-49934)

    usb: xhci: Check endpoint is valid before dereferencing it(CVE-2023-52901)

    gso: fix udp gso fraglist segmentation after pull from frag_list(CVE-2024-49978)

    NFSD: Limit the number of concurrent async COPY operations(CVE-2024-49974)

    drm/amd/display: Initialize denominators' default to 1(CVE-2024-49899)

    igb: Initialize mailbox message for VF reset(CVE-2022-48949)

    tipc: guard against string buffer overrun(CVE-2024-49995)

    net/mlx5: Fix error path in multi-packet WQE transmit(CVE-2024-50001)

    static_call: Handle module init failure correctly in static_call_del_module().(CVE-2024-50002)

    blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race(CVE-2024-50082)

    iommu/vt-d: Fix PCI device refcount leak in has_external_pci()(CVE-2022-49000)

    drm/amd/display: Skip wbscl_set_scaler_filter if filter is null(CVE-2024-46714)

    memcg: fix possible use-after-free in memcg_write_event_control().(CVE-2022-48988)

    ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference(CVE-2022-48999)

    drm/amd/display: Avoid overflow assignment in link_dp_cts(CVE-2024-50016)

    x86/bugs: Use code segment selector for VERW operand(CVE-2024-50072)

    parport: Proper fix for array out-of-bounds access(CVE-2024-50074)

    net: phy: fix null-ptr-deref while probe() failed(CVE-2022-49021)

    ext4: fix timer use-after-free on failed mount(CVE-2024-49960)

    ext4: fix i_data_sem unlock order in ext4_ind_migrate().(CVE-2024-50006)

    ext4: fix access to uninitialised lock in fc replay path(CVE-2024-50014)

    bpf: Prevent tail call between progs attached to different hooks(CVE-2024-50063)

    RDMA/cxgb4: Added NULL check for lookup_atid(CVE-2024-47749)

    nfsd: map the EBADMSG to nfserr_io to avoid warning(CVE-2024-49875)

    iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()(CVE-2022-49002)

    nbd: fix race between timeout and normal completion(CVE-2024-49855)

    io_uring: check if we need to reschedule during overflow flush(CVE-2024-50060)

    ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free(CVE-2024-49983)

    net: Fix an unsafe loop on the list(CVE-2024-50024)

    rtc: cmos: Fix event handler registration ordering issue(CVE-2022-48953)

    gpiolib: fix memory leak in gpiochip_setup_dev().(CVE-2022-48975)

    thermal: core: Reference count the zone in thermal_zone_get_by_id().(CVE-2024-50028)

    nfsd: return -EINVAL when namelen is 0(CVE-2024-47692)

    IB/core: Fix ib_cache_setup_one error flow cleanup(CVE-2024-47693)

    efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption(CVE-2024-49858)

    Bluetooth: Fix not cleanup led when bt_init fails(CVE-2022-48971)

    igb: Do not bring the device up after non-fatal error(CVE-2024-50040)

    uprobes: fix kernel info leak via '[uprobes]' vma(CVE-2024-49975)

    serial: protect uart_port_dtr_rts() in uart_shutdown() too(CVE-2024-50058)

    bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error(CVE-2024-47728)

    NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies().(CVE-2024-50046)

    lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc().(CVE-2024-47668)

    iavf: Fix error handling in iavf_init_module().(CVE-2022-49027)

    netfilter: xtables: avoid NFPROTO_UNSPEC where needed(CVE-2024-50038)

    net: mdio: fix unbalanced fwnode reference count in mdio_device_release().(CVE-2022-48961)

    bpf, lsm: Add check for BPF LSM return value(CVE-2024-47703)

    net/sched: accept TCA_STAB only for root qdisc(CVE-2024-50039)

    block: fix potential invalid pointer dereference in blk_add_partition(CVE-2024-47705)

    drm/amd/display: Check null pointers before using dc-clk_mgr(CVE-2024-49907)

    scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths(CVE-2024-49891)

    nfsd: call cache_put if xdr_reserve_space returns NULL(CVE-2024-47737)

    padata: use integer wrap around to prevent deadlock on seq_nr overflow(CVE-2024-47739)

    ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev().(CVE-2024-47707)

    HID: core: fix shift-out-of-bounds in hid_report_raw_event(CVE-2022-48978)

    af_unix: Get user_ns from in_skb in unix_diag_get_exact().(CVE-2022-48970)

    icmp: change the order of rate limits(CVE-2024-47678)

    vfs: fix race between evice_inodes() and find_inode()iput().(CVE-2024-47679)

    ixgbevf: Fix resource leak in ixgbevf_init_module().(CVE-2022-49028)

    tipc: re-fetch skb cb after tipc_msg_validate(CVE-2022-49017)

    net: tun: Fix use-after-free in tun_detach()(CVE-2022-49014)

    net/mlx5e: Fix use-after-free when reverting termination table(CVE-2022-49025)

    drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error(CVE-2024-47697)

    smb: client: fix UAF in async decryption(CVE-2024-50047)

    drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error(CVE-2024-47698)

    crypto: hisilicon/qm - inject error before stopping queue(CVE-2024-47730)

    bpf: Fix helper writes to read-only maps(CVE-2024-49861)

    ppp: fix ppp_async_encode() illegal access(CVE-2024-50035)

    cifs: Fix buffer overflow when parsing NFS reparse points(CVE-2024-49996)

    libbpf: Handle size overflow for ringbuf mmap(CVE-2022-49030)

    slip: make slhc_remember() more robust against malicious packets(CVE-2024-50033)

    netfilter: br_netfilter: fix panic with metadata_dst skb(CVE-2024-50045)

    ACPI: sysfs: validate return type of _STR method(CVE-2024-49860)

    firmware_loader: Block path traversal(CVE-2024-47742)

    drm/amd/display: Fix index out of bounds in degamma hardware format translation(CVE-2024-49894)

    vhost/scsi: null-ptr-dereference in vhost_scsi_get_req().(CVE-2024-49863)

    uprobe: avoid out-of-bounds memory access of fetching args(CVE-2024-50067)

    ACPI: battery: Fix possible crash when unregistering a battery hook(CVE-2024-49955)

    jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error(CVE-2024-49959)

    ext4: dax: fix overflowing extents beyond inode size when partially writing(CVE-2024-50015)

    udf: Fix preallocation discarding at indirect extent boundary(CVE-2022-48946)

    ext4: avoid OOB when system.data xattr changes underneath the filesystem(CVE-2024-47701)

    fbdev: efifb: Register sysfs groups through driver core(CVE-2024-49925)

    net: do not delay dst_entries_add() in dst_release()(CVE-2024-50036)

    ext4: avoid use-after-free in ext4_ext_show_leaf().(CVE-2024-49889)

    ext4: fix slab-use-after-free in ext4_split_extent_at().(CVE-2024-49884)

    ext4: aovid use-after-free in ext4_ext_insert_extent().(CVE-2024-49883)

    ext4: fix double brelse() the buffer of the extents path(CVE-2024-49882)

    ext4: update orig_path in ext4_find_extent().(CVE-2024-49881)

    ACPI: PAD: fix crash in exit_round_robin().(CVE-2024-49935)

    netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()(CVE-2024-47685)

    scsi: fnic: Move flush_work initialization out of if block(CVE-2024-50025)

    tpm: Clean up TPM space after command failure(CVE-2024-49851)

    tcp: check skb is non-NULL in tcp_rto_delta_us().(CVE-2024-47684)

    sock_map: Add a cond_resched() in sock_hash_free().(CVE-2024-47710)

    vhost_vdpa: assign irq bypass producer token correctly(CVE-2024-47748)

    mm: call the security_mmap_file() LSM hook in remap_file_pages().(CVE-2024-47745)

    x86/ioapic: Handle allocation failures gracefully(CVE-2024-49927)

    mm: avoid leaving partial pfn mappings around in error case(CVE-2024-47674)

    blk_iocost: fix more out of bound shifts(CVE-2024-49933)

    ice: protect XDP configuration with a mutex(CVE-2024-46765)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    bonding: change ipsec_lock from spin lock to mutex(CVE-2024-46678)

    ice: protect XDP configuration with a mutex(CVE-2024-46765)

    sched/smt: Fix unbalance sched_smt_present dec/inc(CVE-2024-44958)

    mm: avoid leaving partial pfn mappings around in error case(CVE-2024-47674)

    blk_iocost: fix more out of bound shifts(CVE-2024-49933)

    x86/ioapic: Handle allocation failures gracefully(CVE-2024-49927)

    In the Linux kernel, the following vulnerability has been resolved:ntb: intel: Fix the NULL vs IS_ERR()     bug for debugfs_create_dir()  The debugfs_create_dir() function returns error pointers. It never returns     NULL. So use IS_ERR() to check it.(CVE-2023-52917)

    mm: call the security_mmap_file() LSM hook in remap_file_pages().(CVE-2024-47745)

    ext4: avoid use-after-free in ext4_ext_show_leaf().(CVE-2024-49889)

    tpm: Clean up TPM space after command failure(CVE-2024-49851)

    sock_map: Add a cond_resched() in sock_hash_free().(CVE-2024-47710)

    tcp: check skb is non-NULL in tcp_rto_delta_us().(CVE-2024-47684)

    ext4: avoid OOB when system.data xattr changes underneath the filesystem(CVE-2024-47701)

    ext4: fix double brelse() the buffer of the extents path(CVE-2024-49882)

    fbdev: efifb: Register sysfs groups through driver core(CVE-2024-49925)

    ext4: fix slab-use-after-free in ext4_split_extent_at().(CVE-2024-49884)

    ext4: aovid use-after-free in ext4_ext_insert_extent().(CVE-2024-49883)

    ACPI: PAD: fix crash in exit_round_robin().(CVE-2024-49935)

    ext4: update orig_path in ext4_find_extent().(CVE-2024-49881)

    padata: use integer wrap around to prevent deadlock on seq_nr overflow(CVE-2024-47739)

    drm/amd/display: Check null pointer before try to access it(CVE-2024-49906)

    netfilter: xtables: avoid NFPROTO_UNSPEC where needed(CVE-2024-50038)

    drm/amd/display: Check null pointers before using dc-clk_mgr(CVE-2024-49907)

    drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error(CVE-2024-47697)

    uprobes: fix kernel info leak via '[uprobes]' vma(CVE-2024-49975)

    ext4: dax: fix overflowing extents beyond inode size when partially writing(CVE-2024-50015)

    net/sched: accept TCA_STAB only for root qdisc(CVE-2024-50039)

    block: fix potential invalid pointer dereference in blk_add_partition(CVE-2024-47705)

    nfsd: map the EBADMSG to nfserr_io to avoid warning(CVE-2024-49875)

    vhost/scsi: null-ptr-dereference in vhost_scsi_get_req().(CVE-2024-49863)

    thermal: core: Reference count the zone in thermal_zone_get_by_id().(CVE-2024-50028)

    bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error(CVE-2024-47728)

    net: mdio: fix unbalanced fwnode reference count in mdio_device_release().(CVE-2022-48961)

    IB/core: Fix ib_cache_setup_one error flow cleanup(CVE-2024-47693)

    bpf: Fix helper writes to read-only maps(CVE-2024-49861)

    nfsd: return -EINVAL when namelen is 0(CVE-2024-47692)

    gpiolib: fix memory leak in gpiochip_setup_dev().(CVE-2022-48975)

    RDMA/cxgb4: Added NULL check for lookup_atid(CVE-2024-47749)

    nfsd: call cache_put if xdr_reserve_space returns NULL(CVE-2024-47737)

    igb: Do not bring the device up after non-fatal error(CVE-2024-50040)

    jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error(CVE-2024-49959)

    crypto: hisilicon/qm - inject error before stopping queue(CVE-2024-47730)

    firmware_loader: Block path traversal(CVE-2024-47742)

    uprobe: avoid out-of-bounds memory access of fetching args(CVE-2024-50067)

    scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths(CVE-2024-49891)

    netfilter: br_netfilter: fix panic with metadata_dst skb(CVE-2024-50045)

    slip: make slhc_remember() more robust against malicious packets(CVE-2024-50033)

    ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev().(CVE-2024-47707)

    icmp: change the order of rate limits(CVE-2024-47678)

    serial: protect uart_port_dtr_rts() in uart_shutdown() too(CVE-2024-50058)

    NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies().(CVE-2024-50046)

    ACPI: battery: Fix possible crash when unregistering a battery hook(CVE-2024-49955)

    efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption(CVE-2024-49858)

    smb: client: fix UAF in async decryption(CVE-2024-50047)

    lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc().(CVE-2024-47668)

    net: Fix an unsafe loop on the list(CVE-2024-50024)

    vfs: fix race between evice_inodes() and find_inode()iput().(CVE-2024-47679)

    io_uring: check if we need to reschedule during overflow flush(CVE-2024-50060)

    ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free(CVE-2024-49983)

    ext4: fix access to uninitialised lock in fc replay path(CVE-2024-50014)

    ext4: fix timer use-after-free on failed mount(CVE-2024-49960)

    ext4: fix i_data_sem unlock order in ext4_ind_migrate().(CVE-2024-50006)

    bpf: Prevent tail call between progs attached to different hooks(CVE-2024-50063)

    NFSD: Limit the number of concurrent async COPY operations(CVE-2024-49974)

    static_call: Handle module init failure correctly in static_call_del_module().(CVE-2024-50002)

    blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race(CVE-2024-50082)

    drm/amd/display: Initialize denominators' default to 1(CVE-2024-49899)

    drm/amd/display: Avoid overflow assignment in link_dp_cts(CVE-2024-50016)

    x86/bugs: Use code segment selector for VERW operand(CVE-2024-50072)

    parport: Proper fix for array out-of-bounds access(CVE-2024-50074)

    tipc: guard against string buffer overrun(CVE-2024-49995)

    gso: fix udp gso fraglist segmentation after pull from frag_list(CVE-2024-49978)

    drm/amd/display: Skip wbscl_set_scaler_filter if filter is null(CVE-2024-46714)

    net/mlx5: Fix error path in multi-packet WQE transmit(CVE-2024-50001)

    fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name(CVE-2024-49934)

    resource: fix region_intersects() vs add_memory_driver_managed().(CVE-2024-49878)

    platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug(CVE-2024-49886)

    net: add more sanity checks to qdisc_pkt_len_init().(CVE-2024-49948)

    RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency(CVE-2024-47696)

    net: avoid potential underflow in qdisc_pkt_len_init() with UFO(CVE-2024-49949)

    smb: client: fix OOBs when building SMB2_IOCTL request(CVE-2024-50151)

    l2tp: prevent possible tunnel refcount underflow(CVE-2024-49940)

    iommu/vt-d: Fix double list_add when enabling VMD in scalable mode(CVE-2022-48916)

    tty: n_gsm: Fix use-after-free in gsm_cleanup_mux(CVE-2024-50073)

    arm64: probes: Remove broken LDR (literal) uprobe support(CVE-2024-50099)

    static_call: Replace pointless WARN_ON() in static_call_module_notify().(CVE-2024-49954)

    tracing: Consider the NULL character when validating the event length(CVE-2024-50131)

    posix-clock: Fix missing timespec64 check in pc_clock_settime().(CVE-2024-50195)

    xfrm: validate new SA's prefixlen using SA family when sel.family is unset(CVE-2024-50142)

    ceph: remove the incorrect Fw reference check when dirtying pages(CVE-2024-50179)

    RDMA/mad: Improve handling of timed out WRs of mad agent(CVE-2024-50095)

    irqchip/gic-v4: Don't allow a VMOVP on a dying VPE(CVE-2024-50192)

    bpf: Use raw_spinlock_t in ringbuf(CVE-2024-50138)

    KVM: x86: Acquire kvm-srcu when handling KVM_SET_VCPU_EVENTS(CVE-2024-46830)

    x86/sgx: Fix deadlock in SGX NUMA node search(CVE-2024-49856)

    nvme-pci: fix race condition between reset and nvme_dev_disable().(CVE-2024-50135)

    NFSD: Initialize struct nfsd4_copy earlier(CVE-2024-50241)

    mm/swapfile: skip HugeTLB pages for unuse_vma(CVE-2024-50199)

    netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6().(CVE-2024-50256)

    net: hns3: fix kernel crash when uninstalling driver(CVE-2024-50296)

    sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start(CVE-2024-49944)

    net: fix crash when config small gso_max_size/gso_ipv4_max_size(CVE-2024-50258)

    bpf: Fix out-of-bounds write in trie_get_next_key().(CVE-2024-50262)

    tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().(CVE-2024-50154)

    netfilter: nft_payload: sanitize offset and length before calling skb_checksum().(CVE-2024-50251)

    be2net: fix potential memory leak in be_xmit().(CVE-2024-50167)

    bpf: support non-r10 register spill/fill to/from stack in precision tracking(CVE-2023-52920)

    udf: fix uninit-value use in udf_get_fileshortad(CVE-2024-50143)

    RDMA/bnxt_re: Add a check for memory allocation(CVE-2024-50209)

    netfilter: nf_tables: prevent nf_skb_duplicated corruption(CVE-2024-49952)

    tpm: Lock TPM chip in tpm_pm_suspend() first(CVE-2024-53085)

    io_uring/rw: fix missing NOWAIT check for O_DIRECT start write(CVE-2024-53052)

    net: missing check virtio(CVE-2024-43817)

    nfs: Fix KMSAN warning in decode_getfattr_attrs().(CVE-2024-53066)

    KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory(CVE-2024-50115)

    security/keys: fix slab-out-of-bounds in key_task_permission(CVE-2024-50301)

    RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages(CVE-2024-50208)

    media: av7110: fix a spectre vulnerability(CVE-2024-50289)

    bpf: Check validity of link-type in bpf_link_show_fdinfo().(CVE-2024-53099)

    filemap: Fix bounds checking in filemap_read().(CVE-2024-50272)

    sctp: properly validate chunk size in sctp_sf_ootb().(CVE-2024-50299)

    arm64: probes: Fix uprobes for big-endian kernels(CVE-2024-50194)

    usb: typec: altmode should keep reference to parent(CVE-2024-50150)

    media: dvbdev: prevent the risk of out of memory access(CVE-2024-53063)

    HID: core: zero-initialize the report buffer(CVE-2024-50302)

    i40e: fix race condition by adding filter's intermediate sync state(CVE-2024-53088)

    ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find().(CVE-2024-50304)

    mm/thp: fix deferred split unqueue naming and locking(CVE-2024-53079)

    vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans(CVE-2024-50264)

    dm cache: fix potential out-of-bounds access on the first resume(CVE-2024-50278)

    net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT(CVE-2024-53057)

    dm cache: fix out-of-bounds access to the dirty bitset when resizing(CVE-2024-50279)

    USB: serial: io_edgeport: fix use after free in debug printk(CVE-2024-50267)

    mm: resolve faulty mmap_region() error path behaviour(CVE-2024-53096)

    media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format(CVE-2024-53104)

    dm cache: fix flushing uninitialized delayed_work on cache_ctr error(CVE-2024-50280)

    smb: client: Fix use-after-free of network namespace.(CVE-2024-53095)

    NFSD: Never decrement pending_async_copies on error(CVE-2024-53073)

    initramfs: avoid filename buffer overrun(CVE-2024-53142)

    netfilter: ipset: add missing range check in bitmap_ip_uadt(CVE-2024-53141)

    net/mlx5: fs, lock FTE when checking if active(CVE-2024-53121)

    virtio/vsock: Fix accept_queue memory leak(CVE-2024-53119)

    dmaengine: idxd: Let probe fail when workqueue cannot be enabled(CVE-2022-48868)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20095 advisory.

    - macsec: Fix use-after-free while sending the offloading packet (Jianbo Liu)  [Orabug: 37268700]     {CVE-2024-50261}
    - net/mlx5e: Fix CT entry update leaks of modify header context (Chris Mi)  [Orabug: 36948578]     {CVE-2024-43864}
    - net/mlx5: Fix missing lock on sync reset reload (Moshe Shemesh)  [Orabug: 36948578] {CVE-2024-42268}
    - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file (Aleksandr Mishin)     [Orabug: 36948578] {CVE-2024-42138}
    - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems (Ido Schimmel)  [Orabug: 36948578]     {CVE-2024-42073}
    - net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (Aleksandr Mishin)  [Orabug:
    36948578] {CVE-2024-40939}
    - net/mlx5: Always stop health timer during driver removal (Shay Drory)  [Orabug: 36948578]     {CVE-2024-40906}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-547.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink: Initialise     extack before use in ACKs Add missing extack initialisation when ACKing BATCH_BEGIN and BATCH_END.
    (CVE-2024-44945)

  - In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small     gso_max_size/gso_ipv4_max_size Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in     sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk->sk_gso_max_size would be much bigger     than device limits. Call Trace: tcp_write_xmit tso_segs = tcp_init_tso_segs(skb, mss_now);
    tcp_set_skb_tso_segs tcp_skb_pcount_set // skb->len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 =     65535 -> 0 tso_segs = DIV_ROUND_UP(skb->len, mss_now) BUG_ON(!tso_segs) Add check for the minimum value of     gso_max_size and gso_ipv4_max_size. (CVE-2024-50258)

  - In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error     path behaviour The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and     numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can     occur. A large amount of the complexity arises from trying to handle errors late in the process of mapping     a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent     state. Taking advantage of previous patches in this series we move a number of checks earlier in the code,     simplifying things by moving the core of the logic into a static internal function __mmap_region(). Doing     this allows us to perform a number of checks up front before we do any real work, and allows us to unwind     the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE     validation unconditionally also. We move a number of things here: 1. We preallocate memory for the     iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform     complicated and error-prone close/free logic. We carefully free iterator state on both success and error     paths. 2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously     the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a     matching mapping_unmap_writable() on success and error paths. We now do this unconditionally if this is a     file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however     doing so does not invalidate the seal check we just performed, and we in any case always decrement the     counter in the wrapper. We perform a debug assert to ensure a driver does not attempt to do the opposite.
    3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64     and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for     this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate     the need for this. With all of these measures in place, we no longer need to explicitly close the VMA on     error paths, as we place all checks which might fail prior to a call to any driver mmap hook. This     eliminates an entire class of errors, makes the code easier to reason about and more robust.
    (CVE-2024-53096)

  - In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames     of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this     type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
    (CVE-2024-53104)

  - In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in     alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in     alloc_pages_bulk_noprof() when the task is migrated between cpusets. When cpuset is enabled, in     prepare_alloc_pages(), ac->nodemask may be t->mems_allowed. when first_zones_zonelist() is called     to find preferred_zoneref, the ac->nodemask may be modified concurrently if the task is migrated between     different cpusets. Assuming we have 2 NUMA Node, when traversing Node1 in ac->zonelist, the nodemask is 2,     and when traversing Node2 in ac->zonelist, the nodemask is 1. As a result, the ac->preferred_zoneref     points to NULL zone. In alloc_pages_bulk_noprof(), for_each_zone_zonelist_nodemask() finds a allowable     zone and calls zonelist_node_idx(ac.preferred_zoneref), leading to NULL pointer dereference.
    __alloc_pages_noprof() fixes this issue by checking NULL pointer in commit ea57485af8f4 (mm, page_alloc:
    fix check for NULL preferred_zone) and commit df76cee6bbeb (mm, page_alloc: remove redundant checks from     alloc fastpath). To fix it, check NULL pointer for preferred_zoneref->zone. (CVE-2024-53113)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4314-1 advisory.

    The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
    - CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking     (bsc#1232823).
    - CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events     (bsc#1220355).
    - CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished()     (bsc#1222587).
    - CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
    - CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
    - CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
    - CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
    - CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
    - CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
    - CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
    - CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
    - CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
    - CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
    - CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
    - CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
    - CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
    - CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
    - CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again'     (bsc#1233132).
    - CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
    - CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
    - CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
    - CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
    - CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
    - CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
    - CVE-2024-49852: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() (bsc#1232819).
    - CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion     (bsc#1232272).
    - CVE-2024-49881: ext4: update orig_path in ext4_find_extent() (bsc#1232201).
    - CVE-2024-49883: ext4: aovid use-after-free in ext4_ext_insert_extent() (bsc#1232199).
    - CVE-2024-49894: drm/amd/display: Fix index out of bounds in degamma hardware format translation     (bsc#1232354).
    - CVE-2024-49895: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation     (bsc#1232352).
    - CVE-2024-49897: drm/amd/display: Check phantom_stream before it is used (bsc#1232355).
    - CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
    - CVE-2024-49901: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (bsc#1232305).
    - CVE-2024-49909: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func     (bsc#1232337).
    - CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func     (bsc#1232366).
    - CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'     (bsc#1232367).
    - CVE-2024-49913: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream     (bsc#1232307).
    - CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
    - CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
    - CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
    - CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
    - CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
    - CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
    - CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
    - CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
    - CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
    - CVE-2024-49959: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error     (bsc#1232149).
    - CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
    - CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
    - CVE-2024-49987: bpftool: Fix undefined behavior in qsort(NULL, 0, ...) (bsc#1232258).
    - CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
    - CVE-2024-50003: drm/amd/display: Fix system hang while resume with TBT monitor (bsc#1232385).
    - CVE-2024-50004: drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35     (bsc#1232396).
    - CVE-2024-50006: ext4: fix i_data_sem unlock order in ext4_ind_migrate() (bsc#1232442).
    - CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
    - CVE-2024-50012: cpufreq: Avoid a bad reference count on CPU node (bsc#1232386).
    - CVE-2024-50014: ext4: fix access to uninitialised lock in fc replay path (bsc#1232446).
    - CVE-2024-50015: ext4: dax: fix overflowing extents beyond inode size when partially writing     (bsc#1232079).
    - CVE-2024-50080: ublk: do not allow user copy for unprivileged device (bsc#1232502).
    - CVE-2024-50081: blk-mq: setup queue ->tag_set before initializing hctx (bsc#1232501).
    - CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
    - CVE-2024-50084: net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() (bsc#1232494).
    - CVE-2024-50087: btrfs: fix uninitialized pointer free on read_alloc_one_name() error (bsc#1232499).
    - CVE-2024-50088: btrfs: fix uninitialized pointer free in add_inode_ref() (bsc#1232498).
    - CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
    - CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
    - CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
    - CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232926).
    - CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
    - CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
    - CVE-2024-50128: net: wwan: fix global oob in wwan_rtnl_policy (bsc#1232905).
    - CVE-2024-50130: netfilter: bpf: must hold reference on net namespace (bsc#1232894).
    - CVE-2024-50138: bpf: Use raw_spinlock_t in ringbuf (bsc#1232935).
    - CVE-2024-50139: KVM: arm64: Fix shift-out-of-bounds bug (bsc#1233062).
    - CVE-2024-50145: octeon_ep: add SKB allocation failures handling in __octep_oq_process_rx()     (bsc#1233044).
    - CVE-2024-50153: scsi: target: core: Fix null-ptr-deref in target_alloc_device() (bsc#1233061).
    - CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
    - CVE-2024-50166: fsl/fman: Fix refcount handling of fman-related devices (bsc#1233050).
    - CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
    - CVE-2024-50169: vsock: Update rx_bytes on read_skb() (bsc#1233320).
    - CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
    - CVE-2024-50177: drm/amd/display: fix a UBSAN warning in DML2.1 (bsc#1233115).
    - CVE-2024-50182: secretmem: disable memfd_secret() if arch cannot set direct map (bsc#1233129).
    - CVE-2024-50184: virtio_pmem: Check device status before requesting flush (bsc#1233135).
    - CVE-2024-50186: net: explicitly clear the sk pointer, when pf->create fails (bsc#1233110).
    - CVE-2024-50192: irqchip/gic-v4: Do not allow a VMOVP on a dying VPE (bsc#1233106).
    - CVE-2024-50225: btrfs: fix error propagation of split bios (bsc#1233193).
    - CVE-2024-50228: mm: shmem: fix data-race in shmem_getattr() (bsc#1233204).
    - CVE-2024-50230: nilfs2: fix kernel bug due to missing clearing of checked flag (bsc#1233206).
    - CVE-2024-50245: fs/ntfs3: Fix possible deadlock in mi_read (bsc#1233203).
    - CVE-2024-50246: fs/ntfs3: Add rough attr alloc_size check (bsc#1233207).
    - CVE-2024-50248: ntfs3: add bounds checking to mi_enum_attr() (bsc#1233219).
    - CVE-2024-50250: fsdax: dax_unshare_iter needs to copy entire blocks (bsc#1233226).
    - CVE-2024-50252: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (bsc#1233201).
    - CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233244).
    - CVE-2024-50261: macsec: Fix use-after-free while sending the offloading packet (bsc#1233253).
    - CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans     (bsc#1233453).
    - CVE-2024-50271: signal: restore the override_rlimit logic (bsc#1233460).
    - CVE-2024-50273: btrfs: reinitialize delayed ref list after deleting it from the list (bsc#1233462).
    - CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
    - CVE-2024-50275: arm64/sve: Discard stale CPU state when handling SVE traps (bsc#1233464).
    - CVE-2024-50276: net: vertexcom: mse102x: Fix possible double free of TX skb (bsc#1233465).
    - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
    - CVE-2024-50289: media: av7110: fix a spectre vulnerability (bsc#1233478).
    - CVE-2024-50295: net: arc: fix the device for dma_map_single/dma_unmap_single (bsc#1233484).
    - CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).
    - CVE-2024-50298: net: enetc: allocate vf_state during PF probes (bsc#1233487).
    - CVE-2024-53042: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()     (bsc#1233540).
    - CVE-2024-53043: mctp i2c: handle NULL header address (bsc#1233523).
    - CVE-2024-53048: ice: fix crash on probe for DPLL enabled E810 LOM (bsc#1233721).
    - CVE-2024-53051: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (bsc#1233547).
    - CVE-2024-53055: wifi: iwlwifi: mvm: fix 6 GHz scan construction (bsc#1233550).
    - CVE-2024-53056: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (bsc#1233568).
    - CVE-2024-53058: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (bsc#1233552).
    - CVE-2024-53079: mm/thp: fix deferred split unqueue naming and locking (bsc#1233570).
    - CVE-2024-53082: virtio_net: Add hash_key_length check (bsc#1233573).
    - CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
    - CVE-2024-53110: vp_vdpa: fix id_table array not null terminated error (bsc#1234085).
    - CVE-2024-53121: net/mlx5: fs, lock FTE when checking if active (bsc#1234078).
    - CVE-2024-53138: net/mlx5e: kTLS, Fix incorrect page refcounting (bsc#1234223).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4316-1 advisory.

    The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2023-52778: mptcp: deal with large GSO size (bsc#1224948).
    - CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking     (bsc#1232823).
    - CVE-2024-26596: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events     (bsc#1220355).
    - CVE-2024-26741: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished()     (bsc#1222587).
    - CVE-2024-26782: mptcp: fix double-free on socket dismantle (bsc#1222590).
    - CVE-2024-26953: net: esp: fix bad handling of pages from page_pool (bsc#1223656).
    - CVE-2024-27017: netfilter: nft_set_pipapo: walk over current view on netlink dump (bsc#1223733).
    - CVE-2024-35888: erspan: make sure erspan_base_hdr is present in skb->head (bsc#1224518).
    - CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
    - CVE-2024-36883: net: fix out-of-bounds access in ops_init (bsc#1225725).
    - CVE-2024-36886: tipc: fix UAF in error path (bsc#1225730).
    - CVE-2024-36905: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (bsc#1225742).
    - CVE-2024-36927: ipv4: Fix uninit-value access in __ip_make_skb() (bsc#1225813).
    - CVE-2024-36954: tipc: fix a possible memleak in tipc_buf_append (bsc#1225764).
    - CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
    - CVE-2024-38589: netrom: fix possible dead-lock in nr_rt_ioctl() (bsc#1226748).
    - CVE-2024-40914: mm/huge_memory: do not unpoison huge_zero_folio (bsc#1227842).
    - CVE-2024-41023: sched/deadline: Fix task_struct reference leak (bsc#1228430).
    - CVE-2024-42102: Revert 'mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again'     (bsc#1233132).
    - CVE-2024-44995: net: hns3: fix a deadlock problem when config TC during resetting (bsc#1230231).
    - CVE-2024-46680: Bluetooth: btnxpuart: Fix random crash seen while removing driver (bsc#1230557).
    - CVE-2024-46681: pktgen: use cpus_read_lock() in pg_net_init() (bsc#1230558).
    - CVE-2024-46765: ice: protect XDP configuration with a mutex (bsc#1230807).
    - CVE-2024-46800: sch/netem: fix use after free in netem_dequeue (bsc#1230827).
    - CVE-2024-47679: vfs: fix race between evice_inodes() and find_inode()&iput() (bsc#1231930).
    - CVE-2024-47701: ext4: avoid OOB when system.data xattr changes underneath the filesystem (bsc#1231920).
    - CVE-2024-47703: bpf, lsm: add check for BPF LSM return value (bsc#1231946).
    - CVE-2024-49868: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion     (bsc#1232272).
    - CVE-2024-49888: bpf: Fix a sdiv overflow issue (bsc#1232208).
    - CVE-2024-49899: drm/amd/display: Initialize denominators' default to 1 (bsc#1232358).
    - CVE-2024-49911: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func     (bsc#1232366).
    - CVE-2024-49912: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream'     (bsc#1232367).
    - CVE-2024-49921: drm/amd/display: Check null pointers before used (bsc#1232371).
    - CVE-2024-49922: drm/amd/display: Check null pointers before using them (bsc#1232374).
    - CVE-2024-49923: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags (bsc#1232361).
    - CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core (bsc#1232224)
    - CVE-2024-49933: blk_iocost: fix more out of bound shifts (bsc#1232368).
    - CVE-2024-49934: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (bsc#1232387).
    - CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start (bsc#1232166).
    - CVE-2024-49945: net/ncsi: Disable the ncsi work before freeing the associated structure (bsc#1232165).
    - CVE-2024-49952: netfilter: nf_tables: prevent nf_skb_duplicated corruption (bsc#1232157).
    - CVE-2024-49968: ext4: filesystems without casefold feature cannot be mounted with siphash (bsc#1232264).
    - CVE-2024-49983: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (bsc#1232096).
    - CVE-2024-49987: bpftool: Fix undefined behavior in qsort(NULL, 0, ...) (bsc#1232258).
    - CVE-2024-49989: drm/amd/display: fix double free issue during amdgpu module unload (bsc#1232483).
    - CVE-2024-50003: drm/amd/display: Fix system hang while resume with TBT monitor (bsc#1232385).
    - CVE-2024-50004: drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35     (bsc#1232396).
    - CVE-2024-50006: ext4: fix i_data_sem unlock order in ext4_ind_migrate() (bsc#1232442).
    - CVE-2024-50009: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (bsc#1232318).
    - CVE-2024-50012: cpufreq: Avoid a bad reference count on CPU node (bsc#1232386).
    - CVE-2024-50014: ext4: fix access to uninitialised lock in fc replay path (bsc#1232446).
    - CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500).
    - CVE-2024-50084: net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() (bsc#1232494).
    - CVE-2024-50087: btrfs: fix uninitialized pointer free on read_alloc_one_name() error (bsc#1232499).
    - CVE-2024-50088: btrfs: fix uninitialized pointer free in add_inode_ref() (bsc#1232498).
    - CVE-2024-50098: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down (bsc#1232881).
    - CVE-2024-50110: xfrm: fix one more kernel-infoleak in algo dumping (bsc#1232885).
    - CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1232919).
    - CVE-2024-50124: Bluetooth: ISO: Fix UAF on iso_sock_timeout (bsc#1232926).
    - CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232928).
    - CVE-2024-50127: net: sched: fix use-after-free in taprio_change() (bsc#1232907).
    - CVE-2024-50128: net: wwan: fix global oob in wwan_rtnl_policy (bsc#1232905).
    - CVE-2024-50130: netfilter: bpf: must hold reference on net namespace (bsc#1232894).
    - CVE-2024-50138: bpf: Use raw_spinlock_t in ringbuf (bsc#1232935).
    - CVE-2024-50139: KVM: arm64: Fix shift-out-of-bounds bug (bsc#1233062).
    - CVE-2024-50145: octeon_ep: add SKB allocation failures handling in __octep_oq_process_rx()     (bsc#1233044).
    - CVE-2024-50153: scsi: target: core: Fix null-ptr-deref in target_alloc_device() (bsc#1233061).
    - CVE-2024-50154: tcp/dccp: Do not use timer_pending() in reqsk_queue_unlink() (bsc#1233070).
    - CVE-2024-50166: fsl/fman: Fix refcount handling of fman-related devices (bsc#1233050).
    - CVE-2024-50167: be2net: fix potential memory leak in be_xmit() (bsc#1233049).
    - CVE-2024-50169: vsock: Update rx_bytes on read_skb() (bsc#1233320).
    - CVE-2024-50171: net: systemport: fix potential memory leak in bcm_sysport_xmit() (bsc#1233057).
    - CVE-2024-50177: drm/amd/display: fix a UBSAN warning in DML2.1 (bsc#1233115).
    - CVE-2024-50182: secretmem: disable memfd_secret() if arch cannot set direct map (bsc#1233129).
    - CVE-2024-50184: virtio_pmem: Check device status before requesting flush (bsc#1233135).
    - CVE-2024-50186: net: explicitly clear the sk pointer, when pf->create fails (bsc#1233110).
    - CVE-2024-50192: irqchip/gic-v4: Do not allow a VMOVP on a dying VPE (bsc#1233106).
    - CVE-2024-50225: btrfs: fix error propagation of split bios (bsc#1233193).
    - CVE-2024-50228: mm: shmem: fix data-race in shmem_getattr() (bsc#1233204).
    - CVE-2024-50230: nilfs2: fix kernel bug due to missing clearing of checked flag (bsc#1233206).
    - CVE-2024-50245: fs/ntfs3: Fix possible deadlock in mi_read (bsc#1233203).
    - CVE-2024-50246: fs/ntfs3: Add rough attr alloc_size check (bsc#1233207).
    - CVE-2024-50248: ntfs3: add bounds checking to mi_enum_attr() (bsc#1233219).
    - CVE-2024-50250: fsdax: dax_unshare_iter needs to copy entire blocks (bsc#1233226).
    - CVE-2024-50252: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (bsc#1233201).
    - CVE-2024-50257: netfilter: Fix use-after-free in get_info() (bsc#1233244).
    - CVE-2024-50261: macsec: Fix use-after-free while sending the offloading packet (bsc#1233253).
    - CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans     (bsc#1233453).
    - CVE-2024-50271: signal: restore the override_rlimit logic (bsc#1233460).
    - CVE-2024-50273: btrfs: reinitialize delayed ref list after deleting it from the list (bsc#1233462).
    - CVE-2024-50274: idpf: avoid vport access in idpf_get_link_ksettings (bsc#1233463).
    - CVE-2024-50275: arm64/sve: Discard stale CPU state when handling SVE traps (bsc#1233464).
    - CVE-2024-50276: net: vertexcom: mse102x: Fix possible double free of TX skb (bsc#1233465).
    - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233468).
    - CVE-2024-50289: media: av7110: fix a spectre vulnerability (bsc#1233478).
    - CVE-2024-50295: net: arc: fix the device for dma_map_single/dma_unmap_single (bsc#1233484).
    - CVE-2024-50296: net: hns3: fix kernel crash when uninstalling driver (bsc#1233485).
    - CVE-2024-50298: net: enetc: allocate vf_state during PF probes (bsc#1233487).
    - CVE-2024-53042: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()     (bsc#1233540).
    - CVE-2024-53043: mctp i2c: handle NULL header address (bsc#1233523).
    - CVE-2024-53048: ice: fix crash on probe for DPLL enabled E810 LOM (bsc#1233721).
    - CVE-2024-53051: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (bsc#1233547).
    - CVE-2024-53055: wifi: iwlwifi: mvm: fix 6 GHz scan construction (bsc#1233550).
    - CVE-2024-53056: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() (bsc#1233568).
    - CVE-2024-53058: net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (bsc#1233552).
    - CVE-2024-53079: mm/thp: fix deferred split unqueue naming and locking (bsc#1233570).
    - CVE-2024-53082: virtio_net: Add hash_key_length check (bsc#1233573).
    - CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).
    - CVE-2024-53110: vp_vdpa: fix id_table array not null terminated error (bsc#1234085).
    - CVE-2024-53121: net/mlx5: fs, lock FTE when checking if active (bsc#1234078).
    - CVE-2024-53138: net/mlx5e: kTLS, Fix incorrect page refcounting (bsc#1234223).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
216030	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1176)	Nessus	Huawei Local Security Checks	critical
216020	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-1140)	Nessus	Huawei Local Security Checks	high
216018	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2025-1159)	Nessus	Huawei Local Security Checks	high
216006	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2025-1192)	Nessus	Huawei Local Security Checks	critical
215966	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20095)	Nessus	Oracle Linux Local Security Checks	high
213606	Photon OS 4.0: Linux PHSA-2025-4.0-0732	Nessus	PhotonOS Local Security Checks	high
213470	Debian dla-4008 : linux-config-6.1 - security update	Nessus	Debian Local Security Checks	critical
213467	CentOS 9 : kernel-5.14.0-547.el9	Nessus	CentOS Local Security Checks	high
213272	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:4387-1)	Nessus	SuSE Local Security Checks	critical
213018	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:4314-1)	Nessus	SuSE Local Security Checks	high
213016	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:4318-1)	Nessus	SuSE Local Security Checks	critical
213015	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:4316-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-53096

high

Tenable Plugins

critical

high

high

critical

high

high

critical

high

critical

high

critical

high