An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte     of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with     a hole in the struct. (CVE-2020-36766)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte     of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with     a hole in the struct. (CVE-2020-36766)

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call. (CVE-2022-45887)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system. (CVE-2023-42754)

  - An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an     event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory     locations outside of the allocated buffer. We recommend upgrading past commit     32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte     of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with     a hole in the struct. (CVE-2020-36766)

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call. (CVE-2022-45887)

  - An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a     use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.
    (CVE-2022-45919)

  - A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality. (CVE-2023-20588)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did     not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN)     attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. (CVE-2023-39189)

  - A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the     flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds     read, leading to a crash or information disclosure. (CVE-2023-39193)

  - A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing     of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local     privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an     information disclosure. (CVE-2023-39194)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was     assumed to be associated with a device before calling __ip_options_compile, which is not always the case     if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash     the system. (CVE-2023-42754)

  - An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux     kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. (CVE-2023-45862)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

  - A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf)     component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an     event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory     locations outside of the allocated buffer. We recommend upgrading past commit     32671e3799ca2e4590773fd0e63aaa4229e50c06. (CVE-2023-5717)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h-nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system.(CVE-2023-42753)

    An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte     of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with     a hole in the struct.(CVE-2020-36766)

    Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access.(CVE-2022-40982)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue().We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8.(CVE-2023-4921)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.When u32_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.(CVE-2023-4208)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.(CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free.We recommend upgrading past commit     b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.(CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free.We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f.(CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free.We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.(CVE-2023-4622)

    An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information.(CVE-2023-20593)

    A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during     cleanup.(CVE-2023-4459)

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality.(CVE-2023-20588)

    A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem.(CVE-2023-4387)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.(CVE-2023-4128)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 ('tun: tun_chr_open(): correctly initialize socket uid'), - 66b2c338adce ('tap: tap_open():
    correctly initialize socket uid'), pass 'inode-i_uid' to sock_init_data_uid() as the last parameter and     that turns out to not be accurate.(CVE-2023-4194)

    A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition.(CVE-2023-4132)

    A flaw was found in the Linux kernels IP framework for transforming packets (XFRM subsystem). This     issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.(CVE-2023-3772)

    A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernels IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%.(CVE-2023-1206)

    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h-nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system.(CVE-2023-42753)

    An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte     of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with     a hole in the struct.(CVE-2020-36766)

    Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access.(CVE-2022-40982)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation.When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue().We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8.(CVE-2023-4921)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation.When u32_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.(CVE-2023-4208)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation.When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free.We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.(CVE-2023-4207)

    A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation.When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free.We recommend upgrading past commit     b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.(CVE-2023-4206)

    A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation.If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free.We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f.(CVE-2023-4623)

    A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation.The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free.We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.(CVE-2023-4622)

    An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information.(CVE-2023-20593)

    A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during     cleanup.(CVE-2023-4459)

    A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss     of confidentiality.(CVE-2023-20588)

    A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem.(CVE-2023-4387)

    A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in     the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to     incorrect handling of the existing filter, leading to a kernel information leak issue.(CVE-2023-4128)

    A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to     bypass network filters and gain unauthorized access to some resources. The original patches fixing     CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits -     a096ccca6e50 ('tun: tun_chr_open(): correctly initialize socket uid'), - 66b2c338adce ('tap: tap_open():
    correctly initialize socket uid'), pass 'inode-i_uid' to sock_init_data_uid() as the last parameter and     that turns out to not be accurate.(CVE-2023-4194)

    A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs     during device initialization when the siano device is plugged in. This flaw allows a local user to crash     the system, causing a denial of service condition.(CVE-2023-4132)

    A flaw was found in the Linux kernels IP framework for transforming packets (XFRM subsystem). This     issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in     xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.(CVE-2023-3772)

    A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernels IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%.(CVE-2023-1206)

    An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a     memory leak because of the lack of a dvb_frontend_detach call.(CVE-2022-45887)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4347-1 advisory.

    The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize) that could cause a local DoS.
    (bsc#1210778)
    - CVE-2023-45862: Fixed an issue in the ENE UB6250 reader driver whwere an object could potentially extend     beyond the end of an allocation causing. (bsc#1216051)
    - CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling. (bsc#1215745).
    - CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a local privileged     (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.
    (bsc#1216046)
    - CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
    - CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
    - CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
    - CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service     (bsc#1215467).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited     by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalation (bsc#1215275).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed a potential information leak in in the CEC driver (bsc#1215299).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4095-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges on the system.
    (bsc#1215150)
    - CVE-2023-4389: Fixed a a double decrement of the reference count flaw in the btrfs filesystem a double     decrement of the reference count, which may have allowed a local attacker with user privilege to crash the     system or may lead to leaked internal kernel information. (bsc#1214351)
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the sch_qfq component which could be exploited to     achieve local privilege escalation. (bsc#1215275)
    - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
    - CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the af_unix component which could be exploited to     achieve local privilege escalation. (bsc#1215117)
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed an issue in drivers/media/cec/core/cec-api.c which could leaks one byte of kernel     memory on specific hardware to unprivileged users. (bsc#1215299)
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs. This flaw could allow a local     attacker to crash the system due to a race problem, possibly leading to a kernel information leak.
    (bsc#1210169)
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system or potentially cause a denial of service. (bsc#1210643)
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-40283: Fixed use-after-free in l2cap_sock_ready_cb (bsc#1214233).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4032-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-39194: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215861)
    - CVE-2023-39193: Fixed a flaw in the processing of state filters which could allow a local attackers to     disclose sensitive information. (bsc#1215860)
    - CVE-2023-39192: Fixed a flaw in the u32_match_it function which could allow a local attackers to     disclose sensitive information. (bsc#1215858)
    - CVE-2023-42754: Fixed a null pointer dereference in ipv4_link_failure which could lead an authenticated     attacker to trigger a DoS. (bsc#1215467)
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table. A user located in the     local network or with a high bandwidth connection can increase the CPU usage of the server that accepts     IPV6 connections up to 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed a potential information leak in in the CEC driver (bsc#1215299).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4030-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order     to leak internal kernel information or crash the system (bsc#1214351).
    - CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter subsystem. This issue may have     allowed a local user to crash the system or potentially escalate their privileges (bsc#1215150).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited     by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-23454: Fixed a type-confusion in the CBQ network scheduler (bsc#1207036).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed a potential information leak in in the CEC driver (bsc#1215299).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network protocol which could allow a     user to crash the system (bsc#1210643).
    - CVE-2023-4881: Fixed an out-of-bounds write flaw in the netfilter subsystem that could lead to     information disclosure or denial of service (bsc#1215221).
    - CVE-2023-40283: Fixed a use-after-free issue in the Bluetooth subsystem (bsc#1214233).
    - CVE-2023-1192: Fixed a use-after-free in the CIFS subsystem (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4031-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    - CVE-2023-39192: Fixed an out of bounds read in the netfilter (bsc#1215858).
    - CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
    - CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
    - CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service     (bsc#1215467).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited     by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalation (bsc#1215275).
    - CVE-2023-0394: Fixed a NULL pointer dereference in the IPv6 stack that could lead to denial of service     (bsc#1207168).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed a potential information leak in in the CEC driver (bsc#1215299).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4033-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem (bsc#1215861).
    - CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem (bsc#1215860).
    - CVE-2023-39192: Fixed an out of bounds read in the netfilter subsystem (bsc#1215858).
    - CVE-2023-42754: Fixed a NULL pointer dereference in the IPv4 stack that could lead to denial of service     (bsc#1215467).
    - CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup table which could be exploited     by network adjacent attackers, increasing CPU usage by 95% (bsc#1212703).
    - CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be     exploited to achieve local privilege escalatio (bsc#1215275).
    - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be     exploited to achieve local privilege escalation (bsc#1215117).
    - CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler which could be exploited to     achieve local privilege escalation (bsc#1215115).
    - CVE-2020-36766: Fixed a potential information leak in in the CEC driver (bsc#1215299).
    - CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which could be exploited to crash     the system (bsc#1210169).
    - CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential     information disclosure or a denial of service (bsc#1215221).
    - CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread() (bsc#1208995).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
249737	Linux Distros Unpatched Vulnerability : CVE-2020-36766	Nessus	Misc.	low
188946	EulerOS Virtualization 2.9.0 : kernel (EulerOS-SA-2024-1011)	Nessus	Huawei Local Security Checks	critical
188935	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-3336)	Nessus	Huawei Local Security Checks	critical
188780	EulerOS 2.0 SP10 : kernel (EulerOS-SA-2023-3217)	Nessus	Huawei Local Security Checks	high
188722	EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2023-3473)	Nessus	Huawei Local Security Checks	high
184345	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:4347-1)	Nessus	SuSE Local Security Checks	high
183287	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:4095-1)	Nessus	SuSE Local Security Checks	high
182905	SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2023:4032-1)	Nessus	SuSE Local Security Checks	high
182903	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:4030-1)	Nessus	SuSE Local Security Checks	high
182902	SUSE SLED12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:4031-1)	Nessus	SuSE Local Security Checks	high
182893	SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2023:4033-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-36766

low

Tenable Plugins

low

critical

critical

high

high

high

high

high

high

high

high