The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to     simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI     error injection through EINJ when securelevel is set. (CVE-2016-3695)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4617-1 advisory.

    The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
    - CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
    - CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
    - CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
    - CVE-2022-3633: Fixed a memory leak in j1939_session_destroy of the file net/can/j1939/transport.c     (bsc#1204650).
    - CVE-2022-3114: Fixed a denial of service in imx_register_uart_clocks() in drivers/clk/imx/clk.c     (bsc#1206391).
    - CVE-2022-3619: Fixed a memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c     (bsc#1204569).
    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect()     and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively)     remotely via Bluetooth (bsc#1205709).
    - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req()     which can be used to leak kernel pointers remotely (bsc#1205705).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-3545: Fixed a use-after-free vulnerability is area_cache_get() of the file     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
    - CVE-2022-3521: Fixed a race condition in kcm_tx_work() of the file net/kcm/kcmsock.c (bsc#1204355).
    - CVE-2022-2153: Fixed a NULL pointer dereference in KVM when attempting to set a SynIC IRQ (bsc#1200788).
    - CVE-2022-33981: Fixed a denial of service, because of a concurrency use-after-free flaw after     deallocating raw_cmd in the raw_cmd_ioctl function (bsc#1200692).
    - CVE-2022-45869: Fixed a race condition in the x86 KVM subsystem which could cause a denial of service     (bsc#1205882).
    - CVE-2022-45888: Fixed a use-after-free during physical removal of a USB devices when using     drivers/char/xillybus/xillyusb.c (bsc#1205764).
    - CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory     (bsc#1205700).
    - CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when     clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
    - CVE-2022-3566: Fixed a race condition in the functions tcp_getsockopt/tcp_setsockopt. The manipulation     leads to a race condition (bsc#1204405).
    - CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection     and io_uring (bsc#1204228).
    - CVE-2022-3176: Fixed a use-after-free in io_uring related to signalfd_poll() and binder_poll()     (bsc#1203391).
    - CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).
    - CVE-2022-3625: Fixed a user-after-free vulnerability in devlink_param_set/devlink_param_get of the file     net/core/devlink.c (bsc#1204637).
    - CVE-2022-3535: Fixed a memory leak in mvpp2_dbgfs_port_init of the file     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bsc#1204417).
    - CVE-2022-39189: Fixed an issue were an unprivileged guest users can compromise the guest kernel because     TLB flush operations were mishandled in certain KVM_VCPU_PREEMPTED situations (bsc#1203066).
    - CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c     (bsc#1204470).
    - CVE-2022-2978: Fixed a use-after-free in the NILFS file system (bsc#1202700).
    - CVE-2022-1184: Fixed a use-after-free and memory errors in ext4 when mounting and operating on a     corrupted image (bsc#1198577).
    - CVE-2022-1263: Fixed a NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty     ring support enabled. This flaw allowed an unprivileged local attacker on the host to issue specific ioctl     calls, causing a kernel oops condition that results in a denial of service (bsc#1198189).
    - CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or     potentially escalate their privileges on the system (bsc#1199904).
    - CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf     of v4l2-mem2mem.c (bsc#1202347).
    - CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-26373: Fixed CPU information leak via post-barrier RSB predictions (bsc#1201726).
    - CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size()     (bsc#1202154).
    - CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured (bsc#1202097).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-28356: Fixed a refcount bug in llc_ui_bind and llc_ui_autobind which could allow an     unprivileged user to execute a denial of service. (bsc#1197391)
    - CVE-2022-2873: Fixed an out-of-bounds memory access flaw that was found in iSMT SMBus host controller     driver (bsc#1202558).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202860).
    - CVE-2022-2938: Fixed a flaw that was found inside the Pressure Stall Information implementation that     could have been used to allow an attacker to crash the system or have other memory-corruption side effects     (bsc#1202623).
    - CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in     pipe_resize_ring() (bsc#1202681).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-3028: Fixed a race condition that was found in the IP framework for transforming packets (XFRM     subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously (bsc#1202898).
    - CVE-2022-3078: Fixed a lack of check after calling vzalloc() and lack of free after allocation in     drivers/media/test-drivers/vidtv/vidtv_s302m.c (bsc#1203041).
    - CVE-2022-3202: Fixed a NULL pointer dereference flaw in Journaled File System. This could allow a local     attacker to crash the system or leak kernel internal information (bsc#1203389).
    - CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege     escalation (bsc#1200015).
    - CVE-2022-32296: Fixed vulnerability where TCP servers were allowed to identify clients by observing what     source ports are used (bsc#1200288).
    - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to     crash the system or escalate their privileges (bsc#1203552).
    - CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bsc#1203769).
    - CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c     (bsc#1204171).
    - CVE-2022-3526: Fixed a memory leak in macvlan_handle_frame() from drivers/net/macvlan.c (bsc#1204353).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bsc#1204619).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bsc#1201948).
    - CVE-2022-36946: Fixed a denial of service inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c     (bsc#1201940).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bsc#1203107).
    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bsc#1203117).
    - CVE-2022-40476: Fixed a null pointer dereference in fs/io_uring.c (bsc#1203435).
    - CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c     (bsc#1202960).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a PCMCIA device while calling ioctl (bsc#1203987).
    - CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a USB device while calling open (bsc#1203992).
    - CVE-2022-42719: Fixed remote code execution with wlan frames when parsing a multi-BSSID element     (bsc#1204051).
    - CVE-2022-42720: Fixed remote code execution due to refcounting bugs (bsc#1204059).
    - CVE-2022-42721: Fixed remote code execution due list corruption in the wlan stack (bsc#1204060).
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
    - CVE-2021-33135: Fixed uncontrolled resource consumption inside Intel(R) SGX that may have allowed an     authenticated user to potentially enable denial of service via local access (bsc#1199515).
    - CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a     DCCP socket. (bsc#1177471)
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bsc#1196616).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bsc#1023051).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3809-1 advisory.

    The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2020-16119: Fixed a use-after-free due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid     object as a listener after being released (bnc#1177471).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-2503: Fixed a LoadPin bypass in Dm-verity (bnc#1202677).
    - CVE-2022-2586: Fixed issue in netfilter that allowed CHAIN_ID to refer to another table (bsc#1202095).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-3169: Fixed a denial of service that resulted in a PCIe link disconnect (bnc#1203290).
    - CVE-2022-32296: Fixed issue where TCP servers were able to identify clients by observing what source     ports are used (bnc#1200288).
    - CVE-2022-3239: Fixed a use-after-free in the video4linux driver (bnc#1203552).
    - CVE-2022-3303: Fixed a race at SNDCTL_DSP_SYNC (bsc#1203769).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-40768: Fixed information leak in drivers/scsi/stex.c due to stex_queuecommand_lck lack a memset     for the PASSTHRU_CMD case (bnc#1203514).
    - CVE-2022-41218: Fixed a use-after-free due to refcount races at releasing (bsc#1202960).
    - CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD     move (bnc#1203622).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-41848: Fixed a use-after-free in mgslpc_ops (bsc#1203987).
    - CVE-2022-41849: Fixed a use-after-free in ufx_ops_open() (bsc#1203992).
    - CVE-2022-42719: Fixed MBSSID parsing use-after-free (bsc#1204051).
    - CVE-2022-42720: Fixed BSS refcounting bugs (bsc#1204059).
    - CVE-2022-42721: Avoid nontransmitted BSS list corruption (bsc#1204060).
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device (bsc#1204125).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3609-1 advisory.

    The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module     (bnc#1202154).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bnc#1196616).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
    - CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c     (bnc#1202960).
    - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to     crash the system or escalate their privileges (bnc#1203552).
    - CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a PCMCIA device while calling ioctl (bnc#1203987).
    - CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a USB device while calling open (bnc#1203992).
    - CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
    - CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD     move (bnc#1203622).
    - CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges     to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This     allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and     firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify     firmware updates (bnc#1202677).
    - CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a     DCCP socket. (bnc#1177471)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3450-1 advisory.

    The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-1012: Fixed a memory leak problem that was found in the TCP source port generation algorithm in     net/ipv4/tcp.c (bnc#1199482).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module     (bnc#1202154).
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bnc#1196616).
    - CVE-2022-32250: Fixed a privilege escalation issue in net/netfilter/nf_tables_api.c that allowed a local     user to became root (bnc#1200015)
    - CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local     attacker to cause privilege escalation to root (bnc#1199665).
    - CVE-2022-20166: Fixed possible out of bounds write due to a heap buffer overflow in various methods of     kernel base drivers (bnc#1200598).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3288-1 advisory.

    The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c     (bnc#1201940).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-3078: Fixed a lack of check after calling vzalloc() and lack of free after allocation in     drivers/media/test-drivers/vidtv/vidtv_s302m.c (bnc#1203041).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in     pipe_resize_ring() (bnc#1202681).
    - CVE-2022-2938: Fixed a flaw that was found inside the Pressure Stall Information implementation that     could have been used to allow an attacker to crash the system or have other memory-corruption side effects     (bnc#1202623).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2873: Fixed an out-of-bounds memory access flaw that was found in iSMT SMBus host controller     driver (bnc#1202558).
    - CVE-2022-28693: Fixed x86/speculation behavior by disabling RRSBA (bsc#1201455).
    - CVE-2022-28356: Fixed a refcount leak bug that was found in net/llc/af_llc.c (bnc#1197391).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module     (bnc#1202154).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors that may have allowed information disclosure via local access (bnc#1201726).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-2585: Fixed missing cleanup of CPU timers before freeing them during exec (bsc#1202094).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-1184: Fixed an use-after-free flaw in fs/ext4/namei.c:dx_insert_block() in the filesystem sub-     component (bnc#1198577).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bnc#1198702).
    - CVE-2021-33135: Fixed uncontrolled resource consumption inside Intel(R) SGX that may have allowed an     authenticated user to potentially enable denial of service via local access (bnc#1199515).
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bnc#1196616).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3293-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-3078: Fixed a lack of check after calling vzalloc() and lack of free after allocation in     drivers/media/test-drivers/vidtv/vidtv_s302m.c (bnc#1203041).
    - CVE-2022-28356: Fixed a refcount leak bug that was found in net/llc/af_llc.c (bnc#1197391).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-2938: Fixed a flaw that was found inside the Pressure Stall Information implementation that     could have been used to allow an attacker to crash the system or have other memory-corruption side effects     (bnc#1202623).
    - CVE-2022-28693: Fixed x86/speculation behavior by disabling RRSBA (bsc#1201455).
    - CVE-2021-33135: Fixed uncontrolled resource consumption inside Intel(R) SGX that may have allowed an     authenticated user to potentially enable denial of service via local access (bnc#1199515).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in     pipe_resize_ring() (bnc#1202681 bnc#1202685).
    - CVE-2022-36946: Fixed a denial of service (panic) inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c     (bnc#1201940 bnc#1201941 bnc#1202312 bnc#1202874).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bnc#1198702).
    - CVE-2022-2873: Fixed an out-of-bounds memory access flaw that was found in iSMT SMBus host controller     driver (bnc#1202558).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module     (bnc#1202154).
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bnc#1196616).
    - CVE-2022-32250: Fixed a privilege escalation issue in net/netfilter/nf_tables_api.c that allowed a local     user to became root (bnc#1200015).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3264-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The hid_input_field function in drivers/hid/hid-core.c     in the Linux kernel before 4.6 allows physically     proximate attackers to obtain sensitive information     from kernel memory or cause a denial of service     (out-of-bounds read) by connecting a device, as     demonstrated by a Logitech DJ receiver.(CVE-2016-7915)

  - In the Linux kernel through 4.14.13,     drivers/block/loop.c mishandles lo_release     serialization, which allows attackers to cause a denial     of service (__lock_acquire use-after-free) or possibly     have unspecified other impact.(CVE-2018-5344)

  - In the Linux kernel through 4.14.13, the     rds_cmsg_atomic() function in 'net/rds/rdma.c'     mishandles cases where page pinning fails or an invalid     address is supplied by a user. This can lead to a NULL     pointer dereference in rds_atomic_free_op() and thus to     a system panic.(CVE-2018-5333)

  - In the Linux kernel through 4.14.13, the     rds_message_alloc_sgs() function does not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size() function in 'net/rds/rdma.c') and     thus to a system panic. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-5332)

  - A flaw was found in the upstream kernel Skcipher     component. This vulnerability affects the     skcipher_recvmsg function of the component Skcipher.
    The manipulation with an unknown input leads to a     privilege escalation vulnerability.(CVE-2017-13215)

  - The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel before     4.11, and 4.9.x before 4.9.36, allows remote attackers     to cause a denial of service (use-after-free and memory     corruption) or possibly have unspecified other impact     by leveraging the presence of xt_TCPMSS in an iptables     action.(CVE-2017-18017)

  - The Salsa20 encryption algorithm in the Linux kernel     before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the     AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable.(CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux     kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed,     allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the     SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted     sequence of system calls that encounter a missing SHA-3     initialization.(CVE-2017-17806)

  - he KEYS subsystem in the Linux kernel before 4.14.6     omitted an access-control check when adding a key to     the current task's 'default request-key keyring' via     the request_key() system call, allowing a local user to     use a sequence of crafted system calls to add keys to a     keyring with only Search permission (not Write     permission) to that keyring, related to     construct_get_dest_keyring() in     security/keys/request_key.c.(CVE-2017-17807)

  - The Linux Kernel 2.6.32 and later are affected by a     denial of service, by flooding the diagnostic port 0x80     an exception can be triggered leading to a kernel     panic.(CVE-2017-1000407)

  - The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11     allows local users to gain privileges or cause a denial     of service (use-after-free) via a crafted SO_RCVBUF     setsockopt system call in conjunction with     XFRM_MSG_GETPOLICY Netlink messages.(CVE-2017-16939)

  - The dccp_disconnect function in net/dccp/proto.c in the     Linux kernel through 4.14.3 allows local users to gain     privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state.(CVE-2017-8824)

  - net/netfilter/nfnetlink_cthelper.c in the Linux kernel     through 4.14.4 does not require the CAP_NET_ADMIN     capability for new, get, and del operations, which     allows local users to bypass intended access     restrictions because the nfnl_cthelper_list data     structure is shared across all net     namespaces.(CVE-2017-17448)

  - Use-after-free vulnerability in the snd_pcm_info     function in the ALSA subsystem in the Linux kernel     allows attackers to gain privileges via unspecified     vectors.(CVE-2017-0861)

  - The usb_destroy_configuration function in     drivers/usb/core/config.c in the USB core subsystem in     the Linux kernel through 4.14.5 does not consider the     maximum number of configurations and interfaces before     attempting to release resources, which allows local     users to cause a denial of service (out-of-bounds write     access) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-17558)

  - The __netlink_deliver_tap_skb function in     net/netlink/af_netlink.c in the Linux kernel through     4.14.4, when CONFIG_NLMON is enabled, does not restrict     observations of Netlink messages to a single net     namespace, which allows local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system.(CVE-2017-17449)

  - net/netfilter/xt_osf.c in the Linux kernel through     4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which     allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces.(CVE-2017-17450)

  - The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel before     3.19 does not ensure that an l2cap socket is available,     which allows local users to gain privileges via a     crafted application.(CVE-2017-15868)

  - The einj_error_inject function in     drivers/acpi/apei/einj.c in the Linux kernel allows     local users to simulate hardware errors and     consequently cause a denial of service by leveraging     failure to disable APEI error injection through EINJ     when securelevel is set.(CVE-2016-3695)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
219742	Linux Distros Unpatched Vulnerability : CVE-2016-3695	Nessus	Misc.	medium
169292	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:4617-1)	Nessus	SuSE Local Security Checks	high
166751	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:3809-1)	Nessus	SuSE Local Security Checks	high
166257	SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2022:3609-1)	Nessus	SuSE Local Security Checks	high
165564	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:3450-1)	Nessus	SuSE Local Security Checks	high
165235	SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2022:3288-1)	Nessus	SuSE Local Security Checks	high
165230	SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / dlm-kmp-64kb / etc (SUSE-SU-2022:3293-1)	Nessus	SuSE Local Security Checks	high
165201	SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / etc (SUSE-SU-2022:3264-1)	Nessus	SuSE Local Security Checks	high
106406	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1031)	Nessus	Huawei Local Security Checks	critical

Detections

Analytics

CVE-2016-3695

medium

Tenable Plugins

medium

high

high

high

high

high

high

high

critical