The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3446 advisory.

  - A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with     capabilities was found in the Linux kernel's OverlayFS subsystem in how a user copies a capable file from     a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges     on the system. (CVE-2023-0386)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3446-1 : linux-5.10 - LTS security update

high Nessus Plugin ID 176729

Version 1.2