In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References: Upstream kernel

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This
    could lead to local escalation of privilege with System execution privileges needed. User interaction is
    not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References:
    Upstream kernel (CVE-2022-20409)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References:
    Upstream kernel (CVE-2022-20409)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the linux package has been released.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects     the function vsock_connect of the file net/vmw_vsock/af_vsock.c of the component IPsec. The manipulation     leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier     assigned to this vulnerability.(CVE-2022-3629)

    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability.(CVE-2022-3567)

    drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory.(CVE-2022-43750)

    In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References:
    Upstream kernel(CVE-2022-20409)

    A flaw was found in the Linux kernel. A race issue occurs between an io_uring request and the Unix socket     garbage collector, allowing an attacker local privilege escalation.(CVE-2022-2602)

    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.(CVE-2022-42432)

    A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability.(CVE-2022-3545)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability.(CVE-2022-3625)

    A vulnerability classified as critical has been found in Linux Kernel. Affected is the function     btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to     use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability     is VDB-211032.(CVE-2022-3534)

    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.(CVE-2022-3606)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability.(CVE-2022-3623)

    A flaw was found in the Linux kernels networking code. A use-after-free was found in the way the     sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and     freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a     denial of service.(CVE-2022-3586)

    A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020.(CVE-2022-3523)

    An out-of-bounds memory write flaw was found in the Linux kernels Kid-friendly Wired Controller driver.
    This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in     bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have     inputs. However, malicious devices can break this assumption, leaking to out-of-bound     write.(CVE-2022-3577)

    A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability.(CVE-2022-3566)

    A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the     function bnx2x_tpa_stop of the file drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c of the component BPF.
    The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211042 is     the identifier assigned to this vulnerability.(CVE-2022-3542)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability.(CVE-2022-3524)

    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.(CVE-2022-20423)

    In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race     condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.(CVE-2022-20422)

    A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability.(CVE-2022-3435)

    mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double     reuse.(CVE-2022-42703)

    A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition(CVE-2022-3303)

    roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a report-     value is in progress.(CVE-2022-41850)

    A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system.(CVE-2022-3239)

    An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations.(CVE-2022-39189)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain.(CVE-2022-39190)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs.(CVE-2022-39188)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects     the function vsock_connect of the file net/vmw_vsock/af_vsock.c of the component IPsec. The manipulation     leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier     assigned to this vulnerability.(CVE-2022-3629)

    A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects     the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to     race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier     assigned to this vulnerability.(CVE-2022-3567)

    drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory.(CVE-2022-43750)

    In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation.(CVE-2022-20409)

    A flaw was found in the Linux kernel. A race issue occurs between an io_uring request and the Unix socket     garbage collector, allowing an attacker local privilege escalation.(CVE-2022-2602)

    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.(CVE-2022-42432)

    A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability     is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the     component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this     issue. The identifier VDB-211045 was assigned to this vulnerability.(CVE-2022-3545)

    A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function     devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier     VDB-211929 was assigned to this vulnerability.(CVE-2022-3625)

    A vulnerability classified as critical has been found in Linux Kernel. Affected is the function     btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to     use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability     is VDB-211032.(CVE-2022-3534)

    A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the     function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation     leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier     VDB-211749 was assigned to this vulnerability.(CVE-2022-3606)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation     leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix     this issue. The identifier VDB-211921 was assigned to this vulnerability.(CVE-2022-3623)

    A flaw was found in the Linux kernels networking code. A use-after-free was found in the way the     sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and     freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a     denial of service.(CVE-2022-3586)

    A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown     function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after     free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-211020.(CVE-2022-3523)

    An out-of-bounds memory write flaw was found in the Linux kernels Kid-friendly Wired Controller driver.
    This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in     bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have     inputs. However, malicious devices can break this assumption, leaking to out-of-bound     write.(CVE-2022-3577)

    A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function     tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It     is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this     vulnerability.(CVE-2022-3566)

    A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the     function bnx2x_tpa_stop of the file drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c of the component BPF.
    The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211042 is     the identifier assigned to this vulnerability.(CVE-2022-3542)

    A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this     vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to     memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue.
    The identifier VDB-211021 was assigned to this vulnerability.(CVE-2022-3524)

    In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This     could lead to local escalation of privilege if a malicious USB device is attached with no additional     execution privileges needed. User interaction is not needed for exploitation.(CVE-2022-20423)

    In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race     condition. This could lead to local escalation of privilege with no additional execution privileges     needed. User interaction is not needed for exploitation.(CVE-2022-20422)

    A vulnerability classified as problematic has been found in Linux Kernel. This affects the function     fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to     out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to     fix this issue. The identifier VDB-210357 was assigned to this vulnerability.(CVE-2022-3435)

    mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double     reuse.(CVE-2022-42703)

    A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition(CVE-2022-3303)

    roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition     and resultant use-after-free in certain situations where a report is received while copying a report-     value is in progress.(CVE-2022-41850)

    A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system.(CVE-2022-3239)

    An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations.(CVE-2022-39189)

    An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain.(CVE-2022-39190)

    An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs.(CVE-2022-39188)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
452273	Google: sys-kernel/lakitu-kernel-5_10: security update to 17033.0.0	Tenable Cloud Security	Google COS Security Checks	Local	medium
452273	Google: sys-kernel/lakitu-kernel-5_10: security update to 17033.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
247645	Linux Distros Unpatched Vulnerability : CVE-2022-20409	Nessus	Misc.	Local	medium
203263	Photon OS 4.0: Linux PHSA-2022-4.0-0248	Nessus	PhotonOS Local Security Checks	Local	high
176860	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2023-2072)	Nessus	Huawei Local Security Checks	Local	high
176821	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2023-2124)	Nessus	Huawei Local Security Checks	Local	high
169573	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-1037)	Nessus	Huawei Local Security Checks	Local	high
169569	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-1012)	Nessus	Huawei Local Security Checks	Local	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2022-20409

medium

Tenable Plugins

medium

medium

medium

high

high

high

high

high

high