The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-13043 advisory.

    - nvmet-tcp: Fix a possible UAF in queue intialization setup (Sagi Grimberg)  [Orabug: 36028025]     {CVE-2023-5178}
    - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky)  [Orabug: 35857365]     {CVE-2023-5090}
    - netfilter: nf_tables: disallow rule removal from chain binding (Pablo Neira Ayuso) [Orabug: 35865117]     {CVE-2023-5197}
    - netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP (Jozsef Kadlecsik) [Orabug:
    35865151] {CVE-2023-42756}
    - netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction (Pablo Neira Ayuso)     [Orabug: 35814389] {CVE-2023-4244}
    - netfilter: nf_tables: adapt set backend to use GC transaction API (Pablo Neira Ayuso) [Orabug: 35814389]     {CVE-2023-4244}
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) [Orabug: 35814453] {CVE-2023-4921}
    - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) [Orabug: 35924095]     {CVE-2023-45871}
    - igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU (Eric Dumazet) [Orabug: 35923998]     {CVE-2023-42752}
    - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) [Orabug: 35810514]     {CVE-2023-4623}
    - uek-rpm: Disable kernel support for CONFIG_FIREWIRE in OL9 (Yifei Liu)  [Orabug: 35493648]     {CVE-2023-3159}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2023-13043)

high Nessus Plugin ID 186962

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.4 Oct 22, 2024, 6:42 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202410221842
Version 1.3 Jun 19, 2024, 9:24 AM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C") CVSS metrics ("CVSSv2 score" set to 9.0) Plugin Feed: 202406190924
Version 1.2 Jan 17, 2024, 2:38 PM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv3 score" set to 9.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C". "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") Plugin Feed: 202401171438
Version 1.1 Jan 5, 2024, 3:16 PM CVSS metrics ("CVSSv2 score" set to 9.0. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C". "CVSSv3 score" set to 8.8. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2023-45871" to "CVE-2023-5178") Plugin Feed: 202401051516
Version 1.0 Dec 15, 2023, 4:55 PM New Plugin Feed: 202312151655