The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5069 advisory.

    - x86/tsx: Add a feature bit for TSX control MSR support {CVE-2023-1637}
    - x86/speculation: Restore speculation related MSRs {CVE-2023-1637}
    - x86/pm: Save the MSR validity status at context setup {CVE-2023-1637}
    - x86/pm: Fix false positive kmemleak report in msr_build_context() {CVE-2023-1637}
    - x86/cpu: Restore AMD's DE_CFG MSR after resume {CVE-2023-1637}
    - x86/pm: Add enumeration check before spec MSRs {CVE-2023-1637}
    - arm64: efi: Execute runtime services from a dedicated {CVE-2023-21102}
    - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3390}
    - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain {CVE-2023-3390}
    - netfilter: nf_tables: unbind non-anonymous set if rule construction fails {CVE-2023-3390}
    - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID {CVE-2023-4147}
    - netfilter: nf_tables: do not ignore genmask when looking up chain by id {CVE-2023-31248}
    - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval {CVE-2023-35001}
    - netfilter: nft_set_pipapo: fix improper element removal {CVE-2023-4004}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 9 : kernel (ELSA-2023-5069)

critical Nessus Plugin ID 181478

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.4 Nov 2, 2024, 5:10 AM CVSS metrics ("Cvssv4 score" set to 9.3) Detection (updated detection logic) Plugin Feed: 202411020510
Version 1.3 Oct 23, 2024, 7:37 AM CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") Plugin Feed: 202410230737
Version 1.2 Oct 22, 2024, 9:14 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H") Plugin metadata Plugin Feed: 202410222114
Version 1.1 Oct 4, 2023, 4:16 PM CVE (set "CVE" coverage to "CVE-2023-1637,CVE-2023-3390,CVE-2023-3776,CVE-2023-4004,CVE-2023-4147,CVE-2023-21102,CVE-2023-31248,CVE-2023-35001") Detection Plugin Feed: 202310041616
Version 1.0 Sep 15, 2023, 8:18 PM New Plugin Feed: 202309152018