The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12169 advisory.

    - drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
    - nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
    - HID: check empty report_list in hid_validate_values() {CVE-2023-1073}
    - Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
    - can: af_can: fix NULL pointer dereference in can_rcv_filter {CVE-2023-2166}
    - net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
    - perf: Disallow mis-matched inherited group reads {CVE-2023-5717}
    - perf/core: Fix potential NULL deref {CVE-2023-5717}
    - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6536 CVE-2023-6535     CVE-2023-6356}
    - nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - nvmet-tcp: remove boilerplate code {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6536 CVE-2023-6535 CVE-2023-6356}
    - smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
    - smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
    - smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
    - net: tls, update curr on splice as well {CVE-2024-0646}
    - netfilter: nft_set_pipapo: skip inactive elements during set walk {CVE-2023-6817}
    - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : kernel (ELSA-2024-12169)

high Nessus Plugin ID 190914

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Nov 2, 2024, 7:54 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202411020754
Version 1.1 Sep 22, 2024, 1:40 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202409220140
Version 1.0 Feb 23, 2024, 7:27 AM New Plugin Feed: 202402230727