The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5255 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-     tuning for systems with extremely high determinism requirements.

    Security Fix(es):

    * kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling     named and anonymous sets in batch requests (CVE-2023-3390)

    * kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt()     (CVE-2023-35788)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593,zenbleed)

    * kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval()     (CVE-2023-35001,ZDI-CAN-20721)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in     tcf_change_indev function (CVE-2023-3776)

    * kernel: netfilter: use-after-free due to improper element removal in     nft_pipapo_remove() (CVE-2023-4004)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the RHEL-8.8.z3 source tree (BZ#2227068)

    * pods get restarted due to failed probes (BZ#2227238)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : kernel-rt (RHSA-2023:5255)

critical Nessus Plugin ID 181632

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.5 Nov 7, 2024, 11:28 PM CVSS metrics ("Cvssv4 score" set to 9.3) Plugin metadata Plugin Feed: 202411072328
Version 1.4 Nov 5, 2024, 9:32 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202411052132
Version 1.3 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.2 Jan 26, 2024, 9:00 PM CVE (set "CVE" coverage to "CVE-2023-1637,CVE-2023-2002,CVE-2023-3090,CVE-2023-3390,CVE-2023-3776,CVE-2023-4004,CVE-2023-20593,CVE-2023-35001,CVE-2023-35788") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202401262100
Version 1.1 Sep 21, 2023, 2:27 PM CVSS metrics ("CVSSv2 score" changed from 6.7 to 6.8. "CVSSv2 vector" changed from "CVSS2#AV:A/AC:L/Au:S/C:P/I:P/A:C" to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C". "CVSSv3 score" changed from 6.8 to 7.8. "CVSSv3 vector" changed from "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H" to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2023-2002" to "CVE-2023-4004") CVSSv3 score source (set to "CVE-2023-4004") CVSSv3 severity (based on CVE-2023-4004, severity increased from "Medium" to "High") Plugin Feed: 202309211427
Version 1.0 Sep 19, 2023, 10:12 PM New Plugin Feed: 202309192212