The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0149-1 advisory.

  - An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in     drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and will cause the null pointer     dereference. (CVE-2022-3104)

  - An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in     drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array(). (CVE-2022-3105)

  - An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in     drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc(). (CVE-2022-3106)

  - An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in     drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the     null pointer dereference. (CVE-2022-3107)

  - An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in     drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup(). (CVE-2022-3108)

  - An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in     drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in     wm8350_init_charger(). (CVE-2022-3111)

  - An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in     drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will     cause the null pointer dereference. (CVE-2022-3112)

  - An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in     drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc()     and will cause the null pointer dereference. (CVE-2022-3113)

  - An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in     drivers/clk/imx/clk.c lacks check of the return value of kcalloc() and will cause the null pointer     dereference. (CVE-2022-3114)

  - An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in     drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null     pointer dereference. (CVE-2022-3115)

  - A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail     to intercept the shutdown of a cooperative nested guest (L2), possibly leading to a page fault and kernel     panic in the host (L0). (CVE-2022-3344)

  - A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087. (CVE-2022-3564)

  - A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel.
    This flaw allows an attacker to conduct a remote denial (CVE-2022-4379)

  - A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches     usb device. A local user could use this flaw to crash the system. (CVE-2022-4662)

  - An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in     drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds     read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
    (CVE-2022-47520)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:0149-1)

high Nessus Plugin ID 170675

Version 1.4

Version 1.3

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.4 Jul 14, 2023, 7:08 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Detection Plugin metadata Plugin Feed: 202307140708
Version 1.3 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737
Version 1.3 Jul 14, 2023, 5:13 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Detection Plugin metadata Plugin Feed: 202307140513
Version 1.2 Mar 7, 2023, 10:48 PM Logic Changes (Added support for additional SUSE Platforms) Plugin Feed: 202303072248
Version 1.1 Feb 4, 2023, 12:45 AM Logic Changes (Added missing service packs to plugin checks) Plugin Feed: 202302040045
Version 1.0 Jan 27, 2023, 12:13 AM New Plugin Feed: 202301270013