The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6071-1 advisory.

    It was discovered that the Traffic-Control Index (TCINDEX) implementation in the Linux kernel did not     properly perform filter deactivation in some situations. A local attacker could possibly use this to gain     elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier     has been removed. (CVE-2023-1829)

    Lin Ma discovered a race condition in the io_uring subsystem in the Linux kernel, leading to a null     pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system     crash). (CVE-2023-0468)

    It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up     operation in some conditions. A local attacker could possibly use this to gain elevated privileges.
    (CVE-2023-0386)

    David Hildenbrand discovered that a race condition existed in the memory manager of the Linux kernel when     handling copy-on-write with shared memory pages. A local attacker could use this to cause a denial of     service (system crash) or execute arbitrary code. (CVE-2022-2590)

    It was discovered that the sound subsystem in the Linux kernel contained a race condition in some     situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-3303)

    Gwnaun Jung discovered that the SFB packet scheduling implementation in the Linux kernel contained a use-     after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2022-3586)

    It was discovered that a race condition existed in the EFI capsule loader driver in the Linux kernel,     leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-40307)

    Zheng Wang and Zhuorao Yang discovered that the RealTek RTL8712U wireless driver in the Linux kernel     contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2022-4095)

    It was discovered that the USB core subsystem in the Linux kernel did not properly handle nested reset     events. A local attacker with physical access could plug in a specially crafted USB device to cause a     denial of service (kernel deadlock). (CVE-2022-4662)

    It was discovered that a race condition existed in the Xen transport layer implementation for the 9P file     system protocol in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use     this to cause a denial of service (guest crash) or expose sensitive information (guest kernel memory).
    (CVE-2023-1859)

    Kyle Zeng discovered that the ATM VC queuing discipline implementation in the Linux kernel contained a     type confusion vulnerability in some situations. An attacker could use this to cause a denial of service     (system crash). (CVE-2023-23455)

    Lianhui Tang discovered that the MPLS implementation in the Linux kernel did not properly handle certain     sysctl allocation failure conditions, leading to a double-free vulnerability. An attacker could use this     to cause a denial of service or possibly execute arbitrary code. (CVE-2023-26545)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175574	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6071-1)	Nessus	Ubuntu Local Security Checks	5/14/2023	9/27/2024	high
191192	CentOS 9 : kernel-5.14.0-347.el9	Nessus	CentOS Local Security Checks	2/29/2024	8/22/2024	critical

Detections

Analytics

Plugins Search

high

critical