The version of kernel installed on the remote host is prior to 5.10.186-179.751. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-038 advisory.

    2024-07-03: CVE-2023-3389 was added to this advisory.

    2023-08-31: CVE-2023-20569 was added to this advisory.

    A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled?address, potentially     leading to information disclosure. (CVE-2023-20569)

    A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local     privilege escalation.

    Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer.

    We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59     (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for     5.15 stable). (CVE-2023-3389)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.

    If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or     decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter     and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

    We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. (CVE-2023-3609)

    An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation.

    The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated     according to packet sizes without bounds checks.

    We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.

    If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or     decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter     and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability.

    We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. (CVE-2023-3776)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-038)

high Nessus Plugin ID 179764

Version 1.4

Version 1.2

Version 1.1

Version 1.0

Version 1.4 Jul 5, 2024, 2:41 PM CVE (set "CVE" coverage to "CVE-2023-20569,CVE-2023-3389,CVE-2023-3609,CVE-2023-3611,CVE-2023-3776") Detection (updated detection logic) Exploit attributes ("Exploitability ease" changed from "Exploits are available" to "No known exploits are available". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202407051441
Version 1.2 Oct 20, 2023, 5:46 PM CVSSv2 severity (based on CVE-2023-3776, severity decreased from "High" to "Medium") CVSSv2 score source (changed from "CVE-2023-20569" to "CVE-2023-3776") CVSS metrics ("CVSSv2 score" changed from 7.8 to 6.8. "CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N" to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202310201746
Version 1.1 Oct 20, 2023, 3:51 PM CVSS metrics ("CVSSv2 score" changed from 7.8 to 6.8) CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N" to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2023-3776, severity decreased from "High" to "Medium") CVSSv2 score source (changed from "CVE-2023-20569" to "CVE-2023-3776") Plugin Feed: 202310201551
Version 1.0 Aug 15, 2023, 12:07 AM New Plugin Feed: 202308150007