The version of kernel installed on the remote host is prior to 4.14.318-240.529. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2100 advisory.

    2024-02-01: CVE-2024-0775 was added to this advisory.

    2024-02-01: CVE-2023-3141 was added to this advisory.

    A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/nf_tables_api.c function in     the Linux kernel. This flaw allows a local, privileged attacker to cause a use-after-free problem at the     time of table deletion, possibly leading to local privilege escalation. (CVE-2022-2586)

    A heap buffer overflow flaw was found in the Linux kernel's Netfilter subsystem in the way a user provides     incorrect input of the NFT_DATA_VERDICT type. This flaw allows a local user to crash or potentially     escalate their privileges on the system. (CVE-2022-34918)

    A denial of service problem was found, due to a possible recursive locking scenario, resulting in a     deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-     component. (CVE-2023-2269)

    do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading     to a race condition (with a resultant use-after-free or NULL pointer dereference). (CVE-2023-28466)

    A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to     achieve local privilege escalation.

    The out-of-bounds write is caused by missing skb->cb  initialization in the ipvlan network driver. The     vulnerability is reachable if CONFIG_IPVLAN is enabled.

    We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. (CVE-2023-3090)

    A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the     Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling     btrfs_ioctl_defrag(). (CVE-2023-3111)

    A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

    An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in     lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an     offset. (CVE-2023-34256)

    A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This     flaw allows a local user to cause an information leak problem while freeing the old quota file names     before a potential failure, leading to a use-after-free. (CVE-2024-0775)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : kernel (ALAS-2023-2100)

critical Nessus Plugin ID 177862

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.5 Jun 26, 2024, 11:05 PM CISA reference Plugin Feed: 202406262305
Version 1.4 Feb 7, 2024, 4:20 PM Exploit attributes ("Exploit framework core" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available". "Exploit framework metasploit" set to "True". "Exploited by malware" set to "True") Plugin Feed: 202402071620
Version 1.3 Feb 7, 2024, 2:22 PM Exploit attributes ("Exploit framework core" set to "True") Exploit attributes ("Exploit framework metasploit" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202402071422
Version 1.2 Jul 20, 2023, 6:12 AM CVE (set "CVE" coverage to "CVE-2022-2586,CVE-2022-34918,CVE-2023-2269,CVE-2023-3090,CVE-2023-3111,CVE-2023-28466,CVE-2023-34256") Detection Plugin metadata Plugin Feed: 202307200612
Version 1.1 Jul 6, 2023, 2:13 PM Exploit attributes ("Exploit framework core" set to "True". "Exploit framework metasploit" set to "True". "Exploited by malware" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202307061413
Version 1.0 Jul 1, 2023, 8:03 AM New Plugin Feed: 202307010803