The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3710 advisory.

  - In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered,     leading to a move_data_page NULL pointer dereference. (CVE-2021-44879)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON     condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a     type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing     memory corruption. (CVE-2023-1077)

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

  - A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In     this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on     hdev devices. (CVE-2023-1989)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on     corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it     has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.
    (CVE-2023-3212)

  - A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in     net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a     dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local     attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit     1240eb93f0616b21c675416516ff3d74798fdc97. (CVE-2023-3390)

  - The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a     way such that not all of the headers would come in one piece. Unfortunately the logic introduced there     didn't account for the extreme case of the entire packet being split into as many pieces as permitted by     the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible)     headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.
    (CVE-2023-34319)

  - Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is     being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt     in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual     device on the other side. As this action will cause console messages to be issued on the other side quite     often, the chance of triggering the deadlock is not neglectable. Note that 32-bit Arm-guests are not     affected, as the 32-bit Linux kernel on Arm doesn't use queued-RW-locks, which are required to trigger the     issue (on Arm32 a waiting writer doesn't block further readers to get the lock). (CVE-2023-34324)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue     may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. (CVE-2023-3772)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the     fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds     read by setting the size fields with a value beyond the array boundaries, leading to a crash or     information disclosure. (CVE-2023-39192)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

  - An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before     6.4.10. There is a use-after-free because the children of an sk are mishandled. (CVE-2023-40283)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation. When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
    (CVE-2023-4206)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. When u32_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.
    (CVE-2023-4208)

  - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to     achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane     transaction and nft_set element garbage collection, it is possible to underflow the reference counter     causing a use-after-free vulnerability. We recommend upgrading past commit     3e91b0ebd994635df2346353322ac51ce84ce6d8. (CVE-2023-4244)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system. (CVE-2023-42754)

  - A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt     pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify`     function. This issue may allow a local user to crash the system and cause a denial of service.
    (CVE-2023-42755)

  - An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-     free because of a vcc_recvmsg race condition. (CVE-2023-51780)

  - An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-     after-free because of an atalk_recvmsg race condition. (CVE-2023-51781)

  - An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-     after-free because of a rose_accept race condition. (CVE-2023-51782)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an     event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory     locations outside of the allocated buffer. We recommend upgrading past commit     32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

  - An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux     Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
    (CVE-2023-6606)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be     exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap     out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit     382c27f4ed28f803b1f1473ac2d8db0afc795a1b. (CVE-2023-6931)

  - A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve     local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on     a RCU read locked object which is freed by another thread. We recommend upgrading past commit     e2b706c691905fe78468c361aaabc719d0a496f1. (CVE-2023-6932)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3710 : hyperv-daemons - security update

critical Nessus Plugin ID 189094

Version 1.1

Version 1.0

Version 1.1 Mar 27, 2024, 7:16 PM Detection (Debian kernel vulns will now be evaluated against the running kernel version instead of the highest installed version) Plugin Feed: 202403271916
Version 1.0 Jan 17, 2024, 12:13 AM New Plugin Feed: 202401170013