The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7337 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by     its CNA. Notes: none. (CVE-2022-23816)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old     filter from the hashtable before freeing it if its handle had the value 0. (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - VMware ESXi contains Return-Stack-Buffer-Underflow (CVE-2022-29901, CVE-2022-28693, CVE-2022-26373) and     Branch Type Confusion (CVE-2022-23816, CVE-2022-23825) vulnerabilities due to the Intel and AMD processors     it utilizes. VMware has evaluated the severity of these issues to be in the Moderate severity range with a     maximum CVSSv3 base score of 5.6. (CVE-2022-28693)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS 7 : kernel (RHSA-2022:7337)

high Nessus Plugin ID 208564

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 10, 2024, 11:57 PM CEA reference Plugin Feed: 202410102357
Version 1.2 Oct 10, 2024, 7:59 AM Exploit attributes ("Exploit framework core" set to "True") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202410100759
Version 1.1 Oct 9, 2024, 10:24 PM New Plugin Feed: 202410092224