The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6343-1 advisory.

    It was discovered that the IPv6 implementation in the Linux kernel contained a high rate of hash     collisions in connection lookup table. A remote attacker could use this to cause a denial of service     (excessive CPU consumption). (CVE-2023-1206)

    Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle     certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker     in a guest VM could use this to cause a denial of service (host system crash) or possibly execute     arbitrary code. (CVE-2023-34319)

    It was discovered that the bluetooth subsystem in the Linux kernel did not properly handle L2CAP socket     release, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2023-40283)

    It was discovered that some network classifier implementations in the Linux kernel contained use-after-     free vulnerabilities. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2023-4128)

    Andy Nguyen discovered that the KVM implementation for AMD processors in the Linux kernel with Secure     Encrypted Virtualization (SEV) contained a race condition when accessing the GHCB page. A local attacker     in a SEV guest VM could possibly use this to cause a denial of service (host system crash).
    (CVE-2023-4155)

    It was discovered that the TUN/TAP driver in the Linux kernel did not properly initialize socket data. A     local attacker could use this to cause a denial of service (system crash). (CVE-2023-4194)

    Maxim Suhanov discovered that the exFAT file system implementation in the Linux kernel did not properly     check a file name length, leading to an out- of-bounds write vulnerability. An attacker could use this to     construct a malicious exFAT image that, when mounted and operated on, could cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2023-4273)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6343-1)

high Nessus Plugin ID 180545

Version 1.5

Version 1.4

Version 1.3

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.5 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.4 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.3 Nov 15, 2023, 2:17 PM CVSSv2 score source (changed from "CVE-2023-4128" to "CVE-2023-40283") Plugin Feed: 202311151417
Version 1.3 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 1.2 Sep 25, 2023, 2:20 PM CVSS metrics ("CVSSv2 score" changed from 5.6 to 6.8. "CVSSv2 vector" changed from "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C" to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202309251420
Version 1.1 Sep 13, 2023, 4:22 PM CVSS metrics ("CVSSv2 score" changed from 6.8 to 5.6. "CVSSv2 vector" changed from "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C" to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") Plugin Feed: 202309131622
Version 1.0 Sep 6, 2023, 5:59 PM New Plugin Feed: 202309061759