In the Linux kernel, the following vulnerability has been resolved: hfsplus: prevent corruption in shrinking truncate I believe there are some issues introduced by commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") HFS+ has extent records which always contains 8 extents. In case the first extent record in catalog file gets full, new ones are allocated from extents overflow file. In case shrinking truncate happens to middle of an extent record which locates in extents overflow file, the logic in hfsplus_file_truncate() was changed so that call to hfs_brec_remove() is not guarded any more. Right action would be just freeing the extents that exceed the new size inside extent record by calling hfsplus_free_extents(), and then check if the whole extent record should be removed. However since the guard (blk_cnt > start) is now after the call to hfs_brec_remove(), this has unfortunate effect that the last matching extent record is removed unconditionally. To reproduce this issue, create a file which has at least 10 extents, and then perform shrinking truncate into middle of the last extent record, so that the number of remaining extents is not under or divisible by 8. This causes the last extent record (8 extents) to be removed totally instead of truncating into middle of it. Thus this causes corruption, and lost data. Fix for this is simply checking if the new truncated end is below the start of this extent record, making it safe to remove the full extent record. However call to hfs_brec_remove() can't be moved to it's previous place since we're dropping ->tree_lock and it can cause a race condition and the cached info being invalidated possibly corrupting the node data. Another issue is related to this one. When entering into the block (blk_cnt > start) we are not holding the ->tree_lock. We break out from the loop not holding the lock, but hfs_find_exit() does unlock it. Not sure if it's possible for someone else to take the lock under our feet, but it can cause hard to debug errors and premature unlocking. Even if there's no real risk of it, the locking should still always be kept in balance. Thus taking the lock now just before the check.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: hfsplus: prevent corruption in     shrinking truncate I believe there are some issues introduced by commit 31651c607151 (hfsplus: avoid     deadlock on file truncation) HFS+ has extent records which always contains 8 extents. In case the first     extent record in catalog file gets full, new ones are allocated from extents overflow file. In case     shrinking truncate happens to middle of an extent record which locates in extents overflow file, the logic     in hfsplus_file_truncate() was changed so that call to hfs_brec_remove() is not guarded any more. Right     action would be just freeing the extents that exceed the new size inside extent record by calling     hfsplus_free_extents(), and then check if the whole extent record should be removed. However since the     guard (blk_cnt > start) is now after the call to hfs_brec_remove(), this has unfortunate effect that the     last matching extent record is removed unconditionally. To reproduce this issue, create a file which has     at least 10 extents, and then perform shrinking truncate into middle of the last extent record, so that     the number of remaining extents is not under or divisible by 8. This causes the last extent record (8     extents) to be removed totally instead of truncating into middle of it. Thus this causes corruption, and     lost data. Fix for this is simply checking if the new truncated end is below the start of this extent     record, making it safe to remove the full extent record. However call to hfs_brec_remove() can't be moved     to it's previous place since we're dropping ->tree_lock and it can cause a race condition and the cached     info being invalidated possibly corrupting the node data. Another issue is related to this one. When     entering into the block (blk_cnt > start) we are not holding the ->tree_lock. We break out from the loop     not holding the lock, but hfs_find_exit() does unlock it. Not sure if it's possible for someone else to     take the lock under our feet, but it can cause hard to debug errors and premature unlocking. Even if     there's no real risk of it, the locking should still always be kept in balance. Thus taking the lock now     just before the check. (CVE-2021-46989)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0926-1 advisory.

    The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
    - CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52482: Fixed a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
    - CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
    - CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
    - CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
    - CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
    - CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
    - CVE-2024-26585: Fixed race between tx work scheduling and socket close  (bsc#1220187).
    - CVE-2023-52340: Fixed ICMPv6 Packet Too Big packets force a DoS of the Linux kernel by forcing     100% CPU (bsc#1219295).
    - CVE-2024-0607: Fixed 64-bit load issue in  nft_byteorder_eval() (bsc#1218915).
    - CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed     (bsc#1220742).
    - CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
    - CVE-2023-52451: Fixed access beyond end of drmem array  (bsc#1220250).
    - CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
    - CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
    - CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
    - CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier  (bsc#1220238).
    - CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
    - CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
    - CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
    - CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
    - CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
    - CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
    - CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
    - CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure _after_  sync'ing     SRCU (bsc#1220745).
    - CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
    - CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
    - CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
    - CVE-2023-52443: Fixed crash when parsed profile name is empty  (bsc#1220240).
    - CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
    - CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
    - CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
    - CVE-2024-26586: Fixed stack corruption (bsc#1220243).
    - CVE-2024-26595: Fixed NULL pointer dereference in  error path (bsc#1220344).
    - CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump  (bsc#1220253).
    - CVE-2024-1151: Fixed unlimited number of recursions from action  sets (bsc#1219835).
    - CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv  (bsc#1219127).
    - CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
    - CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in     drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0857-1 advisory.

    The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
    - CVE-2023-52502: Fixed a race condition in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() (bsc#1220831).
    - CVE-2024-26589: Fixed out of bounds read due to variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255).
    - CVE-2024-26585: Fixed race between tx work scheduling and socket close  (bsc#1220187).
    - CVE-2023-52340: Fixed ICMPv6 Packet Too Big packets force a DoS of the Linux kernel by forcing     100% CPU (bsc#1219295).
    - CVE-2024-0607: Fixed 64-bit load issue in  nft_byteorder_eval() (bsc#1218915).
    - CVE-2023-6817: Fixed use-after-free in nft_pipapo_walk (bsc#1218195).
    - CVE-2024-26622: Fixed UAF write bug in tomoyo_write_control() (bsc#1220825).
    - CVE-2023-52451: Fixed access beyond end of drmem array  (bsc#1220250).
    - CVE-2021-46932: Fixed missing work initialization before device registration (bsc#1220444)
    - CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
    - CVE-2023-52449: Fixed gluebi NULL pointer dereference caused by ftl notifier  (bsc#1220238).
    - CVE-2023-52475: Fixed use-after-free in powermate_config_complete (bsc#1220649)
    - CVE-2023-52478: Fixed kernel crash on receiver USB disconnect (bsc#1220796)
    - CVE-2021-46915: Fixed a bug to avoid possible divide error in nft_limit_init (bsc#1220436).
    - CVE-2021-46924: Fixed fix memory leak in device probe and remove (bsc#1220459)
    - CVE-2019-25162: Fixed a potential use after free (bsc#1220409).
    - CVE-2020-36784: Fixed reference leak when pm_runtime_get_sync fails (bsc#1220570).
    - CVE-2023-52445: Fixed use after free on context disconnection (bsc#1220241).
    - CVE-2023-46343: Fixed a NULL pointer dereference in send_acknowledge() (CVE-2023-46343).
    - CVE-2023-52439: Fixed use-after-free in uio_open (bsc#1220140).
    - CVE-2023-52443: Fixed crash when parsed profile name is empty  (bsc#1220240).
    - CVE-2024-26602: Fixed overall slowdowns with sys_membarrier (bsc1220398).
    - CVE-2024-26593: Fixed block process call transactions (bsc#1220009).
    - CVE-2021-47013: Fixed a use after free in emac_mac_tx_buf_send (bsc#1220641).
    - CVE-2024-26586: Fixed stack corruption (bsc#1220243).
    - CVE-2024-26595: Fixed NULL pointer dereference in  error path (bsc#1220344).
    - CVE-2023-52448: Fixed kernel NULL pointer dereference in gfs2_rgrp_dump  (bsc#1220253).
    - CVE-2024-1151: Fixed unlimited number of recursions from action  sets (bsc#1219835).
    - CVE-2024-23849: Fixed array-index-out-of-bounds in rds_cmsg_recv  (bsc#1219127).
    - CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhost_new_msg() (bsc#1218689).
    - CVE-2023-51042: Fixed use-after-free in amdgpu_cs_wait_all_fences in     drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c (bsc#1219128).
    - CVE-2021-47078: Fixed a bug by clearing all QP fields if creation failed (bsc#1220863)
    - CVE-2021-47076: Fixed a bug by returning CQE error if invalid lkey was supplied (bsc#1220860)
    - CVE-2023-52605: Fixed a NULL pointer dereference check (bsc#1221039)
    - CVE-2023-52569: Fixed a bug in btrfs by remoning BUG() after failure to insert delayed dir index item     (bsc#1220918).
    - CVE-2023-52482: Fixex a bug by adding SRSO mitigation for Hygon processors (bsc#1220735).
    - CVE-2023-52597: Fixed a setting of fpc register in KVM (bsc#1221040).
    - CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
    - CVE-2023-52574: Fixed a bug by hiding new member header_ops (bsc#1220870).
    - CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
    - CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
    - CVE-2023-52532: Fixed a bug in TX CQE error handling (bsc#1220932).
    - CVE-2023-52530: Fixed a potential key use-after-free in wifi mac80211 (bsc#1220930).
    - CVE-2023-52531: Fixed a memory corruption issue in iwlwifi (bsc#1220931).
    - CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
    - CVE-2024-26607: Fixed a probing race issue in sii902x: (bsc#1220736).
    - CVE-2021-47005: Fixed a NULL pointer dereference for ->get_features() (bsc#1220660).
    - CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed     (bsc#1220742).
    - CVE-2021-47012: Fixed a use after free in siw_alloc_mr (bsc#1220627).
    - CVE-2021-46989: Fixed a bug by preventing corruption in shrinking truncate in hfsplus (bsc#1220737).
    - CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure _after_  sync'ing     SRCU (bsc#1220745).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.129-62.227. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-004 advisory.

    A flaw was found in the Linux kernels implementation of wifi fragmentation handling. An attacker with the     ability to transmit within the wireless transmission range of an access point can abuse a flaw where     previous contents of wifi fragments can be unintentionally transmitted to another device. (CVE-2020-24586)

    A flaw was found in the Linux kernel's WiFi implementation. An attacker within the wireless range can     abuse a logic flaw in the WiFi implementation by reassembling packets from multiple fragments under     different keys, treating them as valid. This flaw allows an attacker to send a fragment under an incorrect     key, treating them as a valid fragment under the new key. The highest threat from this vulnerability is to     confidentiality. (CVE-2020-24587)

    A flaw was found in the Linux kernels wifi implementation. An attacker within wireless broadcast range can     inject custom data into the wireless communication circumventing checks on the data.  This can cause the     frame to pass checks and be considered a valid frame of a different type. (CVE-2020-24588)

    Frames used for authentication and key management between the AP and connected clients.  Some clients may     take these redirected frames masquerading as control mechanisms from the AP. (CVE-2020-26139)

    A vulnerability was found in Linux kernel's WiFi implementation.  An attacker within wireless range can     inject a control packet fragment where the kernel does not verify the Message Integrity Check     (authenticity) of fragmented TKIP frames. (CVE-2020-26141)

    A flaw was found in ath10k_htt_rx_proc_rx_frag_ind_hl in drivers/net/wireless/ath/ath10k/htt_rx.c in the     Linux kernel WiFi implementations, where it accepts a second (or subsequent) broadcast fragments even when     sent in plaintext and then process them as full unfragmented frames. The highest threat from this     vulnerability is to integrity. (CVE-2020-26145)

    A flaw was found in ieee80211_rx_h_defragment in net/mac80211/rx.c in the Linux Kernel's WiFi     implementation. This vulnerability can be abused to inject packets or exfiltrate selected fragments when     another device sends fragmented frames, and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
    The highest threat from this vulnerability is to integrity. (CVE-2020-26147)

    A flaw was found in the Linux kernel in certs/blacklist.c, When signature entries for EFI_CERT_X509_GUID     are contained in the Secure Boot Forbidden Signature Database, the entries are skipped. This can cause a     security threat and breach system integrity, confidentiality and even lead to a denial of service problem.
    (CVE-2020-26541)

    A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP),     Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable     to an impersonation attack where an active attacker can impersonate the initiating device without any     previous knowledge. (CVE-2020-26558)

    A flaw was found in the Linux kernel. Improper access control in BlueZ may allow an authenticated user to     potentially enable information disclosure via adjacent access. The highest threat from this vulnerability     is to data confidentiality and integrity. (CVE-2021-0129)

    A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VM_IO|VM_PFNMAP     VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest.
    This flaw allows users who can start and control a VM to read/write random pages of memory, resulting in     local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity,     and system availability. (CVE-2021-22543)

    A flaw was found in the Linux kernel's handling of the removal of Bluetooth HCI controllers. This flaw     allows an attacker with a local account to exploit a race condition, leading to corrupted memory and     possible privilege escalation. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-32399)

    A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux     kernel, where a local attacker with an access rights could cause a denial of service problem on the system     The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in     other places. The highest threat from this vulnerability is to data integrity, confidentiality and system     availability. (CVE-2021-33034)

    The canbus filesystem in the Linux kernel contains an information leak of kernel memory to devices on the     CAN bus network link layer.  An attacker with the ability to dump messages on the CAN bus is able to learn     of uninitialized stack values by dumbing messages on the can bus. (CVE-2021-34693)

    An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux     kernel. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a     system crash or a leak of internal kernel information. The highest threat from this vulnerability is to     system availability. (CVE-2021-3506)

    A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. (CVE-2021-3564)

    A flaw use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in     the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call     hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(),     hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system     or escalate their privileges on the system. (CVE-2021-3573)

    A flaw was found in the Linux kernels NFC implementation, A NULL pointer dereference and BUG leading to a     denial of service can be triggered by a local unprivileged user causing a kernel panic. (CVE-2021-38208)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: usbhid: fix info leak in hid_submit_ctrl

    In hid_submit_ctrl(), the way of calculating the report length doesn'ttake into account that report->size     can be zero. When running thesyzkaller reproducer, a report of size 0 causes hid_submit_ctrl) tocalculate     transfer_buffer_length as 16384. When this urb is passed tothe usb core layer, KMSAN reports an info leak     of 16384 bytes.

    To fix this, first modify hid_report_len() to account for the zeroreport size case by using DIV_ROUND_UP     for the division. Then, call itfrom hid_submit_ctrl(). (CVE-2021-46906)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (CVE-2021-46938)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Restructure trace_clock_global() to never block (CVE-2021-46939)

    In the Linux kernel, the following vulnerability has been resolved:

    md/raid1: properly indicate failure when ending a failed write request

    This patch addresses a data corruption bug in raid1 arrays using bitmaps.Without this fix, the bitmap bits     for the failed I/O end up being cleared.

    Since we are in the failure leg of raid1_end_write_request, the requesteither needs to be retried     (R1BIO_WriteError) or failed (R1BIO_Degraded). (CVE-2021-46950)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: efi: Use local variable for calculating final log size (CVE-2021-46951)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (CVE-2021-46953)

    In the Linux kernel, the following vulnerability has been resolved:

    openvswitch: fix stack OOB read while fragmenting IPv4 packets (CVE-2021-46955)

    In the Linux kernel, the following vulnerability has been resolved:

    virtiofs: fix memory leak in virtio_fs_probe() (CVE-2021-46956)

    In the Linux kernel, the following vulnerability has been resolved:

    spi: Fix use-after-free with devm_spi_alloc_* (CVE-2021-46959)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Return correct error code from smb2_get_enc_key (CVE-2021-46960)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip/gic-v3: Do not enable irqs when handling spurious interrups (CVE-2021-46961)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() (CVE-2021-46963)

    In the Linux kernel, the following vulnerability has been resolved:

    nbd: Fix NULL pointer in flush_workqueue (CVE-2021-46981)

    In the Linux kernel, the following vulnerability has been resolved:

    kyber: fix out of bounds access when preempted (CVE-2021-46984)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: scan: Fix a memory leak in an error handling path (CVE-2021-46985)

    In the Linux kernel, the following vulnerability has been resolved:

    userfaultfd: release page in error path to avoid BUG_ON (CVE-2021-46988)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: prevent corruption in shrinking truncate (CVE-2021-46989)

    In the Linux kernel, the following vulnerability has been resolved:

    i40e: Fix use-after-free in i40e_client_subtask() (CVE-2021-46991)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nftables: avoid overflows in nft_hash_buckets() (CVE-2021-46992)

    In the Linux kernel, the following vulnerability has been resolved:

    sched: Fix out-of-bound access in uclamp (CVE-2021-46993)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: do asoc update earlier in sctp_sf_do_dupcook_a (CVE-2021-46999)

    In the Linux kernel, the following vulnerability has been resolved:

    ceph: fix inode leak on getattr error in __fh_to_dentry (CVE-2021-47000)

    In the Linux kernel, the following vulnerability has been resolved:

    ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hook (CVE-2021-47006)

    In the Linux kernel, the following vulnerability has been resolved:

    net: Only allow init netns to set default tcp cong to a restricted algo (CVE-2021-47010)

    In the Linux kernel, the following vulnerability has been resolved:

    net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (CVE-2021-47013)

    In the Linux kernel, the following vulnerability has been resolved:

    bnxt_en: Fix RX consumer index logic in the error path. (CVE-2021-47015)

    In the Linux kernel, the following vulnerability has been resolved:

    bus: qcom: Put child node before return (CVE-2021-47054)

    In the Linux kernel, the following vulnerability has been resolved:

    mtd: require write permissions for locking and badblock ioctls (CVE-2021-47055)

    In the Linux kernel, the following vulnerability has been resolved:

    regmap: set debugfs_name to NULL after it is freed (CVE-2021-47058)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Stop looking for coalesced MMIO zones if the bus is destroyed (CVE-2021-47060)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Fix a memory leak in error handling paths (CVE-2021-47071)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Clear all QP fields if creation failed (CVE-2021-47078)

    In the Linux kernel, the following vulnerability has been resolved:

    neighbour: allow NUD_NOARP entries to be forced GCed (CVE-2021-47109)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Disable kvmclock on all CPUs on shutdown (CVE-2021-47110)

    In the Linux kernel, the following vulnerability has been resolved:

    x86/kvm: Teardown PV features on boot CPU as well (CVE-2021-47112)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed (CVE-2021-47117)

    In the Linux kernel, the following vulnerability has been resolved:

    pid: take a reference when initializing `cad_pid` (CVE-2021-47118)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: magicmouse: fix NULL-deref on disconnect (CVE-2021-47120)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions (CVE-2021-47126)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nft_ct: skip expectations for confirmed conntrack (CVE-2021-47129)

    In the Linux kernel, the following vulnerability has been resolved:

    cxgb4: avoid accessing registers when clearing filters (CVE-2021-47138)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amdgpu: Fix a use-after-free (CVE-2021-47142)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/amd/amdgpu: fix refcount leak (CVE-2021-47144)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: do not BUG_ON in link_to_fixup_dir (CVE-2021-47145)

    In the Linux kernel, the following vulnerability has been resolved:

    mld: fix panic in mld_newpack() (CVE-2021-47146)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: fix a crash if ->get_sset_count() fails (CVE-2021-47159)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: skb_linearize the head skb when reassembling msgs (CVE-2021-47162)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: wait and exit until all work queues are done (CVE-2021-47163)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() (CVE-2021-47166)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix an Oopsable condition in __nfs_pageio_add_request() (CVE-2021-47167)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: fix an incorrect limit in filelayout_decode_layout() (CVE-2021-47168)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: usbfs: Don't WARN about excessively large memory allocations (CVE-2021-47170)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: fix memory leak in smsc75xx_bind (CVE-2021-47171)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix sysfs leak in alloc_iommu() (CVE-2021-47177)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst refcnt when egressing (CVE-2021-47222)

    In the Linux kernel, the following vulnerability has been resolved:

    net: bridge: fix vlan tunnel dst null pointer dereference (CVE-2021-47223)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Immediately reset the MMU context when the SMM flag is cleared (CVE-2021-47230)

    In the Linux kernel, the following vulnerability has been resolved:

    net: cdc_eem: fix tx fixup skb leak (CVE-2021-47236)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in ip_mc_add1_src (CVE-2021-47238)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: synproxy: Fix out of bounds when parsing TCP options (CVE-2021-47245)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix page reclaim for dead peer hairpin (CVE-2021-47246)

    In the Linux kernel, the following vulnerability has been resolved:

    udp: fix race between close() and udp_abort() (CVE-2021-47248)

    In the Linux kernel, the following vulnerability has been resolved:

    net: rds: fix memory leak in rds_recvmsg (CVE-2021-47249)

    In the Linux kernel, the following vulnerability has been resolved:

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std (CVE-2021-47250)

    In the Linux kernel, the following vulnerability has been resolved:

    gfs2: Fix use-after-free in gfs2_glock_shrink_scan (CVE-2021-47254)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: LAPIC: Restore guard to prevent illegal APIC register access (CVE-2021-47255)

    In the Linux kernel, the following vulnerability has been resolved:

    mm/memory-failure: make sure wait for page writeback in memory_failure (CVE-2021-47256)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: core: Fix error handling of scsi_host_alloc() (CVE-2021-47258)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix use-after-free in nfs4_init_client() (CVE-2021-47259)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a potential NULL dereference in nfs_get_client() (CVE-2021-47260)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/mlx5: Fix initializing CQ fragments buffer (CVE-2021-47261)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message (CVE-2021-47262)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ipoib: Fix warning caused by destroying non-initial netns (CVE-2021-47266)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Correct the length check which causes memory corruption (CVE-2021-47274)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Do not blindly read the ip address in ftrace_bug() (CVE-2021-47276)

    In the Linux kernel, the following vulnerability has been resolved:

    kvm: avoid speculation-based attacks from out-of-range memslot accesses (CVE-2021-47277)

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix use-after-free read in drm_getunique() (CVE-2021-47280)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
260487	Linux Distros Unpatched Vulnerability : CVE-2021-46989	Nessus	Misc.	medium
192487	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:0926-1)	Nessus	SuSE Local Security Checks	high
192014	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:0857-1)	Nessus	SuSE Local Security Checks	high
160440	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-004 (ALASKERNEL-5.4-2022-004)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2021-46989

medium

Tenable Plugins

medium

high

high

high