The version of kernel installed on the remote host is prior to 4.14.294-220.533. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1852 advisory.

    2024-07-03: CVE-2022-42703 was added to this advisory.

    2024-07-03: CVE-2022-3586 was added to this advisory.

    2024-06-06: CVE-2022-48687 was added to this advisory.

    2023-10-12: CVE-2023-2860 was added to this advisory.

    An out-of-bounds write flaw was found in the Linux kernel's framebuffer-based console driver     functionality in the way a user triggers ioctl FBIOPUT_VSCREENINFO with malicious data. This flaw allows a     local user to crash or potentially escalate their privileges on the system. (CVE-2021-33655)

    A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures.
    Internal memory locations could be returned to userspace.  A local attacker with the permissions to insert     eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit     mitigations in place for the kernel. (CVE-2021-4159)

    An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

    A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

    A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it     possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This     flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel     oops condition that results in a denial of service. (CVE-2022-2153)

    A use-after-free flaw was found in route4_change in the net/sched/cls_route.c filter implementation in the     Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege     escalation problem. (CVE-2022-2588)

    An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

    A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

    A flaw was found in the Linux kernel's networking code. A use-after-free was found in the way the sch_sfb     enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed)     into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of     service. (CVE-2022-3586)

    A memory access flaw was found in the Linux kernel's XEN hypervisor for the virtual machine. This flaw     allows a local user to crash the system or potentially escalate their privileges on the system.
    (CVE-2022-36123)

    An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

    A memory corruption flaw was found in the Linux kernel's Netfilter subsystem in the way a local user uses     the libnetfilter_queue when analyzing a corrupted network packet. This flaw allows a local user to crash     the system or a remote user to crash the system when the libnetfilter_queue is used by a local user.
    (CVE-2022-36946)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

    A race condition in the Linux kernel's EFI capsule loader driver was found in the way it handled write and     flush operations on the device node of the EFI capsule. A local user could potentially use this flaw to     crash the system. (CVE-2022-40307)

    mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when     setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment     Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID,     SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and SEG6_ATTR_ALGID. (CVE-2022-48687)

    The upstream advisory describes this issue as follows:

    This vulnerability allows local attackers to disclose sensitive information on affected installations of     the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target     system in order to exploit this vulnerability.

    The specific flaw exists within the processing of seg6 attributes. The issue results from the lack of     proper validation of user-supplied data, which can result in a read past the end of an allocated buffer.
    An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute     arbitrary code in the context of the kernel. (CVE-2023-2860)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : kernel (ALAS-2022-1852)

high Nessus Plugin ID 165990

Version 1.10

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.10 Jul 5, 2024, 2:41 PM CVE (set "CVE" coverage to "CVE-2021-4159,CVE-2021-33655,CVE-2022-1462,CVE-2022-1679,CVE-2022-2153,CVE-2022-2588,CVE-2022-2663,CVE-2022-3028,CVE-2022-3586,CVE-2022-36123,CVE-2022-36879,CVE-2022-36946,CVE-2022-39188,CVE-2022-40307,CVE-2022-42703,CVE-2022-48687,CVE-2023-2860") Detection (updated detection logic) Exploit attributes ("Exploit framework core" set to "True". "Exploitability ease" changed from "Exploits are available" to "No known exploits are available". "Exploited by malware" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202407051441
Version 1.8 Jun 10, 2024, 9:01 AM Exploit attributes ("Exploited by malware" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202406100901
Version 1.7 Jun 8, 2024, 3:36 AM CVE (set "CVE" coverage to "CVE-2021-4159,CVE-2021-33655,CVE-2022-1462,CVE-2022-1679,CVE-2022-2153,CVE-2022-2588,CVE-2022-2663,CVE-2022-3028,CVE-2022-36123,CVE-2022-36879,CVE-2022-36946,CVE-2022-39188,CVE-2022-40307,CVE-2022-48687,CVE-2023-2860") Detection (updated detection logic) Exploit attributes ("Exploit framework core" changed from "True" to none) Exploit attributes ("Exploitability ease" changed from "Exploits are available" to "No known exploits are available") Exploit attributes ("Exploited by malware" changed from "True" to none) Plugin metadata Plugin Feed: 202406080336
Version 1.6 Oct 17, 2023, 6:13 AM Plugin metadata Detection CVE (set "CVE" coverage to "CVE-2021-4159,CVE-2021-33655,CVE-2022-1462,CVE-2022-1679,CVE-2022-2153,CVE-2022-2588,CVE-2022-2663,CVE-2022-3028,CVE-2022-36123,CVE-2022-36879,CVE-2022-36946,CVE-2022-39188,CVE-2022-40307,CVE-2023-2860") Plugin Feed: 202310170613
Version 1.5 Feb 21, 2023, 1:55 AM Regenerated based on advisory update Plugin Feed: 202302210155
Version 1.4 Jan 12, 2023, 6:19 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202301121819
Version 1.3 Oct 11, 2022, 2:45 PM Exploit attributes Plugin Feed: 202210111445