The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5679-1 advisory.

    It was discovered that the SUNRPC RDMA protocol implementation in the Linux kernel did not properly     calculate the header size of a RPC message payload. A local attacker could use this to expose sensitive     information (kernel memory). (CVE-2022-0812)

    Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not     provide sufficient randomization when calculating port offsets. An attacker could possibly use this to     expose sensitive information. (CVE-2022-1012, CVE-2022-32296)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Roger Pau Monn discovered that the Xen virtual block driver in the Linux kernel did not properly     initialize memory pages to be used for shared communication with the backend. A local attacker could use     this to expose sensitive information (guest kernel memory). (CVE-2022-26365)

    Roger Pau Monn discovered that the Xen paravirtualization frontend in the Linux kernel did not properly     initialize memory pages to be used for shared communication with the backend. A local attacker could use     this to expose sensitive information (guest kernel memory). (CVE-2022-33740)

    It was discovered that the Xen paravirtualization frontend in the Linux kernel incorrectly shared     unrelated data when communicating with certain backends. A local attacker could use this to cause a denial     of service (guest crash) or expose sensitive information (guest kernel memory). (CVE-2022-33741,     CVE-2022-33742)

    Oleksandr Tyshchenko discovered that the Xen paravirtualization platform in the Linux kernel on ARM     platforms contained a race condition in certain situations. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2022-33744)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3928-1 advisory.

  - x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in     ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is     why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In     AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit     guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for     virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect     Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative     execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For     more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not     architecturally protect ring 0 from predictions learnt in ring 1. For more details, see:
    https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-     speculation Similar situations may exist with other mitigations for other kinds of speculative execution     attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to     be discovered, disclosed, or mitigated. (CVE-2021-28689)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for     guests may be of significant size. Therefore its freeing may take more time than is reasonable without     intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

  - lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was     inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a     result two cooperating guests granting each other transitive grants can cause locks to be acquired nested     within one another, but in respectively opposite order. With suitable timing between the involved grant     copy operations this may result in the locking up of a CPU. (CVE-2022-33748)

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause     xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored     or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by     the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction     resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the     cleanup after the error will not remove all nodes already created. When the transaction is committed after     this situation, nodes without a valid parent can be made permanent in the data base. (CVE-2022-42310)

  - Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple     CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause     xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of     xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by     issuing new requests to xenstored without reading the responses, causing the responses to be buffered in     memory - - by causing large number of watch events to be generated via setting up multiple xenstore     watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as     allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing     many nodes inside a transaction (CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318)

  - Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest,     xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only     after the request has been finished completely. A request is regarded to be finished only after the guest     has read the response message of the request from the ring page. Thus a guest not reading the response can     cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of     Service (DoS) of xenstored. (CVE-2022-42319)

  - Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are     per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the     domid of the removed domain. This is normally no problem, as those access right entries will be corrected     when such a node is written later. There is a small time window when a new domain is created, where the     access rights of a past domain with the same domid as the new one will be regarded to be still valid,     leading to the new domain being able to get access to a node which was meant to be accessible by the     removed domain. For this to happen another domain needs to write the node before the newly created domain     is being introduced to Xenstore by dom0. (CVE-2022-42320)

  - Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some     Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting     levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. (CVE-2022-42321)

  - Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of     XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow     two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by     domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes     and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and     over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by     Xenstore quota. (CVE-2022-42322, CVE-2022-42323)

  - Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record     relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In     case a node has been created in a transaction and it is later deleted in the same transaction, the     transaction will be terminated with an error. As this error is encountered only when handling the deleted     node at transaction finalization, the transaction will have been performed partially and without updating     the accounting information. This will enable a malicious guest to create arbitrary number of nodes.
    (CVE-2022-42325, CVE-2022-42326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2411-1 advisory.

  - Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result     in data leakage. (CVE-2021-26341)

  - An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in     the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could     potentially use this flaw to crash the system or escalate privileges on the system. (CVE-2021-4157)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds     read due to improper input validation. This could lead to local information disclosure if a malicious USB     HID device were plugged in, with no additional execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream     kernel (CVE-2022-20132)

  - In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead     to local escalation of privilege when opening and closing inet sockets with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-112551163References: Upstream kernel (CVE-2022-20141)

  - In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead     to local escalation of privilege with System execution privileges needed. User interaction is not needed     for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream     kernel (CVE-2022-20154)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-185 advisory.

  - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679)

  - With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID     is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.
    (CVE-2022-1789)

  - A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of     service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal     instruction in guest in the Intel CPU. (CVE-2022-1852)

  - A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal.
    This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.
    (CVE-2022-1973)

  - A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an     attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and     possibly to run code. (CVE-2022-2078)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially     leading to information disclosure. (CVE-2022-23825)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

  - Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution     under certain microarchitecture-dependent conditions. (CVE-2022-29900)

  - Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their     retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can     hijack return instructions to achieve arbitrary speculative code execution under certain     microarchitecture-dependent conditions. (CVE-2022-29901)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

  - There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a     waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before     the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free     to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We     recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659 (CVE-2022-3176)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer     overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR and POKEUSR) when accessing floating point     registers. (CVE-2022-32981)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

  - rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a     double free. (CVE-2022-34494)

  - rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
    (CVE-2022-34495)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

  - The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This     allows Xen PV guest OS users to cause a denial of service or gain privileges. (CVE-2022-36123)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

  - An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. (CVE-2022-39842)

  - An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free. (CVE-2022-40307)

  - A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root     (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD     CPU that supports Secure Encrypted Virtualization (SEV). (CVE-2022-0171) (CVE-2022-21505)

  - kernel: posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585)

  - A use-after-free flaw was found in the Linux kernel's Atheros wireless adapter driver in the way a user     forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local     user to crash or potentially escalate their privileges on the system. (CVE-2022-1679) (CVE-2022-2586)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary     speculative code execution under certain microarchitecture-dependent conditions. (CVE-2022-28693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2892-1 advisory.

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of     ttys could lead to a use-after-free. (CVE-2020-36557)

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause     memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to     5.4.189; version 5.4.24 and later versions. (CVE-2022-1116)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer     overflow. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-182388481References: Upstream kernel (CVE-2022-20166)

  - A bug in the IMA subsystem was discovered which would incorrectly allow kexec to be used when kernel     lockdown was enabled (CVE-2022-21505) (CVE-2022-21505)

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

  - Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text     explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device     frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740).
    Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to     unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend     (CVE-2022-33741, CVE-2022-33742). (CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-33742)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

  - nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote     attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte     nfta_payload attribute, an skb_pull can encounter a negative skb->len. (CVE-2022-36946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5623-1 advisory.

    Asaf Modelevsky discovered that the Intel(R) 10GbE PCI Express (ixgbe) Ethernet driver for the Linux     kernel performed insufficient control flow management. A local attacker could possibly use this to cause a     denial of service. (CVE-2021-33061)

    It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing     font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

    Moshe Kol, Amit Klein and Yossi Gilad discovered that the IP implementation in the Linux kernel did not     provide sufficient randomization when calculating port offsets. An attacker could possibly use this to     expose sensitive information. (CVE-2022-1012, CVE-2022-32296)

    Norbert Slusarek discovered that a race condition existed in the perf subsystem in the Linux kernel,     resulting in a use-after-free vulnerability. A privileged local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2022-1729)

    Qiuhao Li, Gaoning Pan, and Yongkang Jia discovered that the KVM hypervisor implementation in the Linux     kernel did not properly handle an illegal instruction in a guest, resulting in a null pointer dereference.
    An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS.
    (CVE-2022-1852)

    It was discovered that the UDF file system implementation in the Linux kernel contained an out-of-bounds     write vulnerability. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-1943)

    Gerald Lee discovered that the NTFS file system implementation in the Linux kernel did not properly handle     certain error conditions, leading to a use- after-free vulnerability. A local attacker could use this to     cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2022-1973)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    It was discovered that the device-mapper verity (dm-verity) driver in the Linux kernel did not properly     verify targets being loaded into the device- mapper table. A privileged attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-2503)

    Roger Pau Monn discovered that the Xen virtual block driver in the Linux kernel did not properly     initialize memory pages to be used for shared communication with the backend. A local attacker could use     this to expose sensitive information (guest kernel memory). (CVE-2022-26365)

    Zheyu Ma discovered that the Intel iSMT SMBus host controller driver in the Linux kernel contained an out-     of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system     crash). (CVE-2022-2873)

    Selim Enes Karaduman discovered that a race condition existed in the pipe buffers implementation of the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     escalate privileges. (CVE-2022-2959)

    Roger Pau Monn discovered that the Xen paravirtualization frontend in the Linux kernel did not properly     initialize memory pages to be used for shared communication with the backend. A local attacker could use     this to expose sensitive information (guest kernel memory). (CVE-2022-33740)

    It was discovered that the Xen paravirtualization frontend in the Linux kernel incorrectly shared     unrelated data when communicating with certain backends. A local attacker could use this to cause a denial     of service (guest crash) or expose sensitive information (guest kernel memory). (CVE-2022-33741,     CVE-2022-33742)

    Jan Beulich discovered that the Xen network device frontend driver in the Linux kernel incorrectly handled     socket buffers (skb) references when communicating with certain backends. A local attacker could use this     to cause a denial of service (guest crash). (CVE-2022-33743)

    Oleksandr Tyshchenko discovered that the Xen paravirtualization platform in the Linux kernel on ARM     platforms contained a race condition in certain situations. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2022-33744)

    It was discovered that the virtio RPMSG bus driver in the Linux kernel contained a double-free     vulnerability in certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-34494, CVE-2022-34495)

    Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did     not properly handle rules that truncated packets below the packet header size. When such rules are in     place, a remote attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2022-36946)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5633-1 advisory.

    It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing     font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2021-33655)

    Duoming Zhou discovered that race conditions existed in the timer handling implementation of the Linux     kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use     this to cause a denial of service (system crash). (CVE-2022-2318)

    Roger Pau Monn discovered that the Xen virtual block driver in the Linux kernel did not properly     initialize memory pages to be used for shared communication with the backend. A local attacker could use     this to expose sensitive information (guest kernel memory). (CVE-2022-26365)

    Roger Pau Monn discovered that the Xen paravirtualization frontend in the Linux kernel did not properly     initialize memory pages to be used for shared communication with the backend. A local attacker could use     this to expose sensitive information (guest kernel memory). (CVE-2022-33740)

    It was discovered that the Xen paravirtualization frontend in the Linux kernel incorrectly shared     unrelated data when communicating with certain backends. A local attacker could use this to cause a denial     of service (guest crash) or expose sensitive information (guest kernel memory). (CVE-2022-33741,     CVE-2022-33742)

    Jan Beulich discovered that the Xen network device frontend driver in the Linux kernel incorrectly handled     socket buffers (skb) references when communicating with certain backends. A local attacker could use this     to cause a denial of service (guest crash). (CVE-2022-33743)

    Oleksandr Tyshchenko discovered that the Xen paravirtualization platform in the Linux kernel on ARM     platforms contained a race condition in certain situations. An attacker in a guest VM could use this to     cause a denial of service in the host OS. (CVE-2022-33744)

    It was discovered that the virtio RPMSG bus driver in the Linux kernel contained a double-free     vulnerability in certain error conditions. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2022-34494, CVE-2022-34495)

    Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did     not properly handle rules that truncated packets below the packet header size. When such rules are in     place, a remote attacker could possibly use this to cause a denial of service (system crash).
    (CVE-2022-36946)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
166115	Ubuntu 16.04 ESM : Linux kernel (HWE) vulnerabilities (USN-5679-1)	Nessus	Ubuntu Local Security Checks	10/14/2022	8/27/2024	high
167337	SUSE SLES15 Security Update : xen (SUSE-SU-2022:3928-1)	Nessus	SuSE Local Security Checks	11/13/2022	9/8/2023	high
163384	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2411-1)	Nessus	SuSE Local Security Checks	7/22/2022	7/13/2023	high
167017	Amazon Linux 2022 : (ALAS2022-2022-185)	Nessus	Amazon Linux Local Security Checks	11/5/2022	8/22/2024	high
164448	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2892-1)	Nessus	SuSE Local Security Checks	8/26/2022	7/14/2023	high
165280	Ubuntu 20.04 LTS : Linux kernel (HWE) vulnerabilities (USN-5623-1)	Nessus	Ubuntu Local Security Checks	9/21/2022	8/28/2024	high
165320	Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-5633-1)	Nessus	Ubuntu Local Security Checks	9/22/2022	8/27/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high