The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5693-1 advisory.

    David Bouman and Billy Jheng Bing Jhong discovered that a race condition existed in the io_uring subsystem     in the Linux kernel, leading to a use- after-free vulnerability. A local attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2602)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Hao Sun and Jiacheng Xu discovered that the NILFS file system implementation in the Linux kernel contained     a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2022-2978)

    Abhishek Shah discovered a race condition in the PF_KEYv2 implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly expose sensitive     information (kernel memory). (CVE-2022-3028)

    Xingyuan Mo and Gengjia Chen discovered that the Promise SuperTrak EX storage controller driver in the     Linux kernel did not properly handle certain structures. A local attacker could potentially use this to     expose sensitive information (kernel memory). (CVE-2022-40768)

    Snke Huster discovered that an integer overflow vulnerability existed in the WiFi driver stack in the     Linux kernel, leading to a buffer overflow. A physically proximate attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41674)

    Snke Huster discovered that a use-after-free vulnerability existed in the WiFi driver stack in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-42719)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly perform reference     counting in some situations, leading to a use-after-free vulnerability. A physically proximate attacker     could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2022-42720)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel did not properly handle BSSID/SSID     lists in some situations. A physically proximate attacker could use this to cause a denial of service     (infinite loop). (CVE-2022-42721)

    Snke Huster discovered that the WiFi driver stack in the Linux kernel contained a NULL pointer     dereference vulnerability in certain situations. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2022-42722)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5693-1)

high Nessus Plugin ID 166272

Version 1.7

Version 1.6

Version 1.5

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.7 Aug 28, 2024, 11:02 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408282302
Version 1.6 Jan 10, 2024, 8:45 AM Plugin metadata Detection (updated detection logic) Plugin Feed: 202401100845
Version 1.5 Oct 21, 2023, 3:09 AM Detection Plugin metadata Plugin Feed: 202310210309
Version 1.5 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 1.4 Oct 9, 2023, 5:00 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310091700
Version 1.3 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.2 Oct 20, 2022, 5:47 AM New Plugin Feed: 202210200547