A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free().

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003918 advisory.

    A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free().

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004356 advisory.

    A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free().

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before     2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.
    (CVE-2019-0149)

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

  - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
    (CVE-2021-26401)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel (CVE-2022-20423)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from     the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length     heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary     code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged     code on the target system to exploit this vulnerability. (CVE-2022-2991)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

  - A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux     kernel. This could allow a local attacker to crash the system or leak kernel internal information.
    (CVE-2022-3202)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can     actually happen. (CVE-2022-39842)

  - An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free. (CVE-2022-40307)

  - roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a     report->value is in progress. (CVE-2022-41850)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel (CVE-2022-20423)

  - A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the     machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector     (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (CVE-2022-21385)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is     disabled by default, it could allow an attacker to crash the system or have other memory-corruption side     effects. (CVE-2022-2938)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from     the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length     heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary     code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged     code on the target system to exploit this vulnerability. (CVE-2022-2991)

  - Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free. (CVE-2022-40307)

  - roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a     report->value is in progress. (CVE-2022-41850)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before     2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.
    (CVE-2019-0149)

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

  - LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
    (CVE-2021-26401)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel (CVE-2022-20423)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from     the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length     heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary     code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged     code on the target system to exploit this vulnerability. (CVE-2022-2991)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

  - A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux     kernel. This could allow a local attacker to crash the system or leak kernel internal information.
    (CVE-2022-3202)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - ** DISPUTED ** An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in     drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an     integer overflow and bypassing the size check. After that, because it is used as the third argument to     copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can     actually happen. (CVE-2022-39842)

  - An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free. (CVE-2022-40307)

  - roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a     report->value is in progress. (CVE-2022-41850)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

  - A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to     userspace. (CVE-2022-0850)

  - An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a     user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage     of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read     unauthorized random data from memory. (CVE-2022-1462)

  - In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-239842288References: Upstream kernel (CVE-2022-20423)

  - A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the     machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector     (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) (CVE-2022-21385)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw was found in the Linux kernel's implementation of Pressure Stall Information. While the feature is     disabled by default, it could allow an attacker to crash the system or have other memory-corruption side     effects. (CVE-2022-2938)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from     the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length     heap-based buffer. This vulnerability allows a local attacker to escalate privileges and execute arbitrary     code in the context of the kernel. The attacker must first obtain the ability to execute high-privileged     code on the target system to exploit this vulnerability. (CVE-2022-2991)

  - Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver     through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by     zero error. (CVE-2022-3061)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free. (CVE-2022-40307)

  - roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a     report->value is in progress. (CVE-2022-41850)

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3809-1 advisory.

    The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2020-16119: Fixed a use-after-free due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid     object as a listener after being released (bnc#1177471).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-2503: Fixed a LoadPin bypass in Dm-verity (bnc#1202677).
    - CVE-2022-2586: Fixed issue in netfilter that allowed CHAIN_ID to refer to another table (bsc#1202095).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-3169: Fixed a denial of service that resulted in a PCIe link disconnect (bnc#1203290).
    - CVE-2022-32296: Fixed issue where TCP servers were able to identify clients by observing what source     ports are used (bnc#1200288).
    - CVE-2022-3239: Fixed a use-after-free in the video4linux driver (bnc#1203552).
    - CVE-2022-3303: Fixed a race at SNDCTL_DSP_SYNC (bsc#1203769).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-40768: Fixed information leak in drivers/scsi/stex.c due to stex_queuecommand_lck lack a memset     for the PASSTHRU_CMD case (bnc#1203514).
    - CVE-2022-41218: Fixed a use-after-free due to refcount races at releasing (bsc#1202960).
    - CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD     move (bnc#1203622).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-41848: Fixed a use-after-free in mgslpc_ops (bsc#1203987).
    - CVE-2022-41849: Fixed a use-after-free in ufx_ops_open() (bsc#1203992).
    - CVE-2022-42719: Fixed MBSSID parsing use-after-free (bsc#1204051).
    - CVE-2022-42720: Fixed BSS refcounting bugs (bsc#1204059).
    - CVE-2022-42721: Avoid nontransmitted BSS list corruption (bsc#1204060).
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device (bsc#1204125).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3609-1 advisory.

    The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module     (bnc#1202154).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bnc#1196616).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769).
    - CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c     (bnc#1202960).
    - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to     crash the system or escalate their privileges (bnc#1203552).
    - CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a PCMCIA device while calling ioctl (bnc#1203987).
    - CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a USB device while calling open (bnc#1203992).
    - CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bnc#1202095).
    - CVE-2022-41222: Fixed a use-after-free via a stale TLB because an rmap lock is not held during a PUD     move (bnc#1203622).
    - CVE-2022-2503: Fixed a bug in dm-verity, device-mapper table reloads allowed users with root privileges     to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This     allowed root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and     firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify     firmware updates (bnc#1202677).
    - CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a     DCCP socket. (bnc#1177471)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3450-1 advisory.

    The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-1012: Fixed a memory leak problem that was found in the TCP source port generation algorithm in     net/ipv4/tcp.c (bnc#1199482).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).
    - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module     (bnc#1202154).
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bnc#1196616).
    - CVE-2022-32250: Fixed a privilege escalation issue in net/netfilter/nf_tables_api.c that allowed a local     user to became root (bnc#1200015)
    - CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local     attacker to cause privilege escalation to root (bnc#1199665).
    - CVE-2022-20166: Fixed possible out of bounds write due to a heap buffer overflow in various methods of     kernel base drivers (bnc#1200598).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3264-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bnc#1203117).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bnc#1203107).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bnc#1201948).
    - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM     subsystem) (bnc#1202898).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202564,     bsc#1202860).
    - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be     confused and incorrectly matches the message (bnc#1202097).
    - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel     Processors (bnc#1201726).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due     to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535).
    - CVE-2021-4155: Fixed a data leak flaw that was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS     filesystem (bnc#1194272).
    - CVE-2020-27784: Fixed a vulnerability that was found in printer_ioctl() printer_ioctl() when accessing a     deallocated instance (bnc#1202895).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bnc#1023051).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
288717	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003918)	Nessus	Unity Linux Local Security Checks	medium
288319	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004356)	Nessus	Unity Linux Local Security Checks	medium
246602	Linux Distros Unpatched Vulnerability : CVE-2020-27784	Nessus	Misc.	medium
169864	EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2023-1147)	Nessus	Huawei Local Security Checks	high
169729	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2023-1168)	Nessus	Huawei Local Security Checks	high
168977	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2823)	Nessus	Huawei Local Security Checks	high
168961	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-2848)	Nessus	Huawei Local Security Checks	high
166751	SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:3809-1)	Nessus	SuSE Local Security Checks	high
166257	SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2022:3609-1)	Nessus	SuSE Local Security Checks	high
165564	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:3450-1)	Nessus	SuSE Local Security Checks	high
165201	SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / etc (SUSE-SU-2022:3264-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-27784

medium

Tenable Plugins

medium

medium

medium

high

high

high

high

high

high

high

high