The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0575 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue (BZ#2230094)

    * kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: hid: Use After Free in asus_remove() (CVE-2023-1079)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb() (CVE-2023-4132)

    * kernel: A heap out-of-bounds write (CVE-2023-5717)

    * kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion     (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (CVE-2023-28328)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() (CVE-2023-33203)

    * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() (CVE-2023-35823)

    * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() (CVE-2023-35824)

    * kernel: r592: race condition leading to use-after-free in r592_remove() (CVE-2023-35825)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free bug in r592_remove (CVE-2023-3141)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [RHEL 8.9] Proactively backport locking fixes from upstream (BZ#2235393)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6583 advisory.

  - Kernel: race when faulting a device private page in memory manager (CVE-2022-3523)

  - kernel: use-after-free in l1oip timer handlers (CVE-2022-3565)

  - kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

  - kernel: vmwgfx: use-after-free in vmw_cmd_res_check (CVE-2022-38457)

  - kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context (CVE-2022-40133)

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c (CVE-2022-42895)

  - kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597)

  - kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

  - kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

  - kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

  - kernel: tap: tap_open(): correctly initialize socket uid (CVE-2023-1076)

  - kernel: hid: Use After Free in asus_remove() (CVE-2023-1079)

  - kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206)

  - kernel: missing mmap_lock in file_files_note that could possibly lead to a use after free in the coredump     code (CVE-2023-1249)

  - kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

  - Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c (CVE-2023-1652)

  - kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

  - kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989)

  - kernel:  A possible deadlock in dm_get_inactive_table in dm- ioctl.c leads to dos (CVE-2023-2269)

  - kernel: Use after free bug in r592_remove (CVE-2023-3141)

  - kernel: fbcon: shift-out-of-bounds in fbcon_set_font() (CVE-2023-3161)

  - kernel: gfs2: NULL pointer dereference in gfs2_evict_inode() (CVE-2023-3212)

  - kernel: out-of-bounds access in relay_file_read (CVE-2023-3268)

  - kernel: NULL pointer dereference due to missing kalloc() return value check in shtp_cl_get_dma_send_buf()     (CVE-2023-3358)

  - kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

  - kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() (CVE-2023-3772)

  - kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr (CVE-2023-3773)

  - kernel: KVM: SEV-ES / SEV-SNP VMGEXIT double fetch vulnerability (CVE-2023-4155)

  - kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid     (CVE-2023-4194)

  - kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

  - kernel: exFAT: stack overflow in exfat_get_uniname_from_ext_entry (CVE-2023-4273)

  - kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

  - kernel: KVM: nVMX: missing consistency checks for CR0 and CR4 (CVE-2023-30456)

  - kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() (CVE-2023-33203)

  - kernel: vmwgfx: race condition leading to information disclosure vulnerability (CVE-2023-33951)

  - kernel: vmwgfx: double free within the handling of vmw_buffer_object objects (CVE-2023-33952)

  - kernel: r592: race condition leading to use-after-free in r592_remove() (CVE-2023-35825)

  - kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0724 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * kernel: improper input validation may lead to privilege escalation (CVE-2021-4204)

    * kernel: memory leak for large arguments in video_usercopy function in     drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

    * kernel: eBPF verification flaw (CVE-2021-34866)

    * kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges     (CVE-2022-0500)

    * kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * kernel: possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    * kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

    * kernel: netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * kernel: memory leak in ipv6_renew_options() (CVE-2022-3524)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

    * kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed     (CVE-2022-3707)

    * kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * kernel: local privileges escalation in kernel/bpf/verifier.c (CVE-2022-23222)

    * kernel: Executable Space Protection Bypass (CVE-2022-25265)

    * kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

    * kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
189813	RHEL 8 : kernel (RHSA-2024:0575)	Nessus	Red Hat Local Security Checks	1/30/2024	6/19/2024	high
194262	RHEL 9 : kernel (RHSA-2023:6583)	Nessus	Red Hat Local Security Checks	4/28/2024	4/28/2024	high
190110	RHEL 8 : kernel (RHSA-2024:0724)	Nessus	Red Hat Local Security Checks	2/7/2024	6/26/2024	high

Detections

Analytics

Plugins Search

high

high

high