The version of kernel installed on the remote host is prior to 5.15.75-48.135. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.15-2022-010 advisory.

  - drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information     from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
    (CVE-2022-40768)

  - A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects     the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The     manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a     patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. (CVE-2022-3646)

  - The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer     overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send     buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer     to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC     message with garbage data is still correctly formed according to the specification and is passed forward     to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the     allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (CVE-2022-43945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2022-010)

medium Nessus Plugin ID 167237

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.5 Apr 4, 2023, 12:12 PM Plugin metadata Plugin Feed: 202304041212
Version 1.4 Mar 22, 2023, 9:58 AM Regenerated based on advisory update Plugin Feed: 202303220958
Version 1.3 Nov 30, 2022, 4:19 PM CVSS metrics ("CVSSv2 score" changed from "5.0" to "4.6") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N" to "CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N") Plugin Feed: 202211301619
Version 1.2 Nov 10, 2022, 3:52 AM New Plugin Feed: 202211100352