drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4617-1 advisory.

    The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
    - CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
    - CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
    - CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
    - CVE-2022-3633: Fixed a memory leak in j1939_session_destroy of the file net/can/j1939/transport.c     (bsc#1204650).
    - CVE-2022-3114: Fixed a denial of service in imx_register_uart_clocks() in drivers/clk/imx/clk.c     (bsc#1206391).
    - CVE-2022-3619: Fixed a memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c     (bsc#1204569).
    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect()     and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively)     remotely via Bluetooth (bsc#1205709).
    - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req()     which can be used to leak kernel pointers remotely (bsc#1205705).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-3545: Fixed a use-after-free vulnerability is area_cache_get() of the file     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
    - CVE-2022-3521: Fixed a race condition in kcm_tx_work() of the file net/kcm/kcmsock.c (bsc#1204355).
    - CVE-2022-2153: Fixed a NULL pointer dereference in KVM when attempting to set a SynIC IRQ (bsc#1200788).
    - CVE-2022-33981: Fixed a denial of service, because of a concurrency use-after-free flaw after     deallocating raw_cmd in the raw_cmd_ioctl function (bsc#1200692).
    - CVE-2022-45869: Fixed a race condition in the x86 KVM subsystem which could cause a denial of service     (bsc#1205882).
    - CVE-2022-45888: Fixed a use-after-free during physical removal of a USB devices when using     drivers/char/xillybus/xillyusb.c (bsc#1205764).
    - CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory     (bsc#1205700).
    - CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when     clearing sk_user_data can lead to a race condition and NULL pointer dereference. (bsc#1205711)
    - CVE-2022-3566: Fixed a race condition in the functions tcp_getsockopt/tcp_setsockopt. The manipulation     leads to a race condition (bsc#1204405).
    - CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection     and io_uring (bsc#1204228).
    - CVE-2022-3176: Fixed a use-after-free in io_uring related to signalfd_poll() and binder_poll()     (bsc#1203391).
    - CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver (bsc#1204780).
    - CVE-2022-3625: Fixed a user-after-free vulnerability in devlink_param_set/devlink_param_get of the file     net/core/devlink.c (bsc#1204637).
    - CVE-2022-3535: Fixed a memory leak in mvpp2_dbgfs_port_init of the file     drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c (bsc#1204417).
    - CVE-2022-39189: Fixed an issue were an unprivileged guest users can compromise the guest kernel because     TLB flush operations were mishandled in certain KVM_VCPU_PREEMPTED situations (bsc#1203066).
    - CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c     (bsc#1204470).
    - CVE-2022-2978: Fixed a use-after-free in the NILFS file system (bsc#1202700).
    - CVE-2022-1184: Fixed a use-after-free and memory errors in ext4 when mounting and operating on a     corrupted image (bsc#1198577).
    - CVE-2022-1263: Fixed a NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty     ring support enabled. This flaw allowed an unprivileged local attacker on the host to issue specific ioctl     calls, causing a kernel oops condition that results in a denial of service (bsc#1198189).
    - CVE-2022-1882: Fixed a use-after-free flaw in free_pipe_info() that could allow a local user to crash or     potentially escalate their privileges on the system (bsc#1199904).
    - CVE-2022-20369: Fixed possible out of bounds write due to improper input validation in v4l2_m2m_querybuf     of v4l2-mem2mem.c (bsc#1202347).
    - CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095).
    - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096).
    - CVE-2022-26373: Fixed CPU information leak via post-barrier RSB predictions (bsc#1201726).
    - CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reserve_sfa_size()     (bsc#1202154).
    - CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured (bsc#1202097).
    - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346).
    - CVE-2022-28356: Fixed a refcount bug in llc_ui_bind and llc_ui_autobind which could allow an     unprivileged user to execute a denial of service. (bsc#1197391)
    - CVE-2022-2873: Fixed an out-of-bounds memory access flaw that was found in iSMT SMBus host controller     driver (bsc#1202558).
    - CVE-2022-2905: Fixed tnum_range usage on array range checking for poke descriptors (bsc#1202860).
    - CVE-2022-2938: Fixed a flaw that was found inside the Pressure Stall Information implementation that     could have been used to allow an attacker to crash the system or have other memory-corruption side effects     (bsc#1202623).
    - CVE-2022-2959: Fixed a race condition that was found inside the watch queue due to a missing lock in     pipe_resize_ring() (bsc#1202681).
    - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672).
    - CVE-2022-3028: Fixed a race condition that was found in the IP framework for transforming packets (XFRM     subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously (bsc#1202898).
    - CVE-2022-3078: Fixed a lack of check after calling vzalloc() and lack of free after allocation in     drivers/media/test-drivers/vidtv/vidtv_s302m.c (bsc#1203041).
    - CVE-2022-3202: Fixed a NULL pointer dereference flaw in Journaled File System. This could allow a local     attacker to crash the system or leak kernel internal information (bsc#1203389).
    - CVE-2022-32250: Fixed user-after-free in net/netfilter/nf_tables_api.c that could allow local privilege     escalation (bsc#1200015).
    - CVE-2022-32296: Fixed vulnerability where TCP servers were allowed to identify clients by observing what     source ports are used (bsc#1200288).
    - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to     crash the system or escalate their privileges (bsc#1203552).
    - CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bsc#1203769).
    - CVE-2022-3435: Fixed an out-of-bounds read in fib_nh_match() of the file net/ipv4/fib_semantics.c     (bsc#1204171).
    - CVE-2022-3526: Fixed a memory leak in macvlan_handle_frame() from drivers/net/macvlan.c (bsc#1204353).
    - CVE-2022-3640: Fixed use-after-free in l2cap_conn_del() in net/bluetooth/l2cap_core.c (bsc#1204619).
    - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could     be dropped twice (bsc#1201948).
    - CVE-2022-36946: Fixed a denial of service inside nfqnl_mangle in net/netfilter/nfnetlink_queue.c     (bsc#1201940).
    - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page     while it still has stale TLB entries (bsc#1203107).
    - CVE-2022-39190: Fixed an issue that was discovered in net/netfilter/nf_tables_api.c and could cause a     denial of service upon binding to an already bound chain (bsc#1203117).
    - CVE-2022-40476: Fixed a null pointer dereference in fs/io_uring.c (bsc#1203435).
    - CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c     (bsc#1202960).
    - CVE-2022-41674: Fixed a DoS issue where kernel can crash on the reception of specific WiFi Frames     (bsc#1203770).
    - CVE-2022-41848: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a PCMCIA device while calling ioctl (bsc#1203987).
    - CVE-2022-41849: Fixed a race condition and resultant use-after-free if a physically proximate attacker     removes a USB device while calling open (bsc#1203992).
    - CVE-2022-42719: Fixed remote code execution with wlan frames when parsing a multi-BSSID element     (bsc#1204051).
    - CVE-2022-42720: Fixed remote code execution due to refcounting bugs (bsc#1204059).
    - CVE-2022-42721: Fixed remote code execution due list corruption in the wlan stack (bsc#1204060).
    - CVE-2022-42722: Fixed crash in beacon protection for P2P-device. (bsc#1204125)
    - CVE-2021-33135: Fixed uncontrolled resource consumption inside Intel(R) SGX that may have allowed an     authenticated user to potentially enable denial of service via local access (bsc#1199515).
    - CVE-2020-16119: Fixed a use-after-free vulnerability exploitable by a local attacker due to reuse of a     DCCP socket. (bsc#1177471)
    - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject     data into or terminate a victim's TCP session (bsc#1196616).
    - CVE-2016-3695: Fixed an issue inside the einj_error_inject function in drivers/acpi/apei/einj.c that     allowed users to simulate hardware errors and consequently cause a denial of service (bsc#1023051).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4611-1 advisory.

    The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism     (bsc#1177282).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured (bsc#1202097).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the     efi firmware capsule-loader.c (bsc#1203322).
    - CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and     mgslpc_detach (bsc#1203987).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4615-1 advisory.

    The SUSE Linux Enterprise 12  SP4 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec (bsc#1206207).
    - CVE-2022-42328: Guests could trigger denial of service via the netback driver (bsc#1206114).
    - CVE-2022-42329: Guests could trigger denial of service via the netback driver (bsc#1206113).
    - CVE-2022-3643: Guests could trigger NIC interface reset/abort/crash via netback driver (bsc#1206113).
    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c's l2cap_connect()     and l2cap_le_connect_req() which may have allowed code execution and leaking kernel memory (respectively)     remotely via Bluetooth (bsc#1205709).
    - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c's l2cap_parse_conf_req()     which can be used to leak kernel pointers remotely (bsc#1205705).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the     efi firmware capsule-loader.c (bsc#1203322).
    - CVE-2022-3545: Fixed a use-after-free in area_cache_get() of the file     drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c (bsc#1204415).
    - CVE-2022-3521: Fixed a race condition in kcm_tx_work() of the file net/kcm/kcmsock.c (bsc#1204355).
    - CVE-2022-2153: Fixed a NULL pointer dereference in the KVM subsystem, when attempting to set a SynIC IRQ     (bsc#1200788).
    - CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and     mgslpc_detach (bsc#1203987).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4561-1 advisory.

    The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.


    The following security bugs were fixed:

    - CVE-2022-3635: Fixed a use-after-free in the tst_timer() of the file drivers/atm/idt77252.c     (bsc#1204631).
    - CVE-2022-3424: Fixed use-after-free in gru_set_context_option(), gru_fault() and     gru_handle_user_call_os() that could lead to kernel panic (bsc#1204166).
    - CVE-2022-41850: Fixed a race condition in roccat_report_event() in drivers/hid/hid-roccat.c     (bsc#1203960).
    - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in     net/bluetooth/l2cap_core.c (bsc#1205796).
    - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker() in wifi/brcmfmac     (bsc#1204868).
    - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops()/inet6_dgram_ops() (bsc#1204414).
    - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout() in drivers/net/slip (bsc#1205671).
    - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation (bsc#1205128).
    - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver (bsc#1205514).
    - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver (bsc#1205220).
    - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices (bsc#1202686).
    - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS     file-system with an unintended group ownership and with group execution and SGID permission bits set     (bsc#1198702).
    - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor's     internal memory (bsc#1204653).
    - CVE-2020-26541: Enforce the secure boot forbidden signature database (aka dbx) protection mechanism     (bsc#1177282).
    - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop() in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c     (bsc#1204402).
    - CVE-2022-3629: Fixed memory leak in vsock_connect() in net/vmw_vsock/af_vsock.c (bsc#1204635).
    - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer() in fs/nilfs2/segment.c (bsc#1204646).
    - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode() in fs/nilfs2/inode.c (bsc#1204647).
    - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level() in fs/nilfs2/inode.c     (bsc#1204574).
    - CVE-2022-3594: Fixed excessive data logging in intr_callback() in drivers/net/usb/r8152.c (bsc#1204479).
    - CVE-2022-3586: Fixed use-after-free in socket buffer (SKB) that could allow a local unprivileged user to     cause a denial of service (bsc#1204439).
    - CVE-2022-3565: Fixed use-after-free in del_timer() in drivers/isdn/mISDN/l1oip_core.c (bsc#1204431).
    - CVE-2022-3524: Fixed memory leak in ipv6_renew_options() in the IPv6 handler (bsc#1204354).
    - CVE-2022-2663: Fixed an issue which allowed a firewall to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured (bsc#1202097).
    - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive     information from kernel memory (bsc#1203514).
    - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse (bsc#1204168).
    - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET     (bsc#1203290).
    - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the     efi firmware capsule-loader.c (bsc#1203322).
    - CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and     mgslpc_detach (bsc#1203987).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3844-1 advisory.

  - A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled.
    This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a     kernel oops condition that results in a denial of service. (CVE-2022-1263)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux     kernel. This could allow a local attacker to crash the system or leak kernel internal information.
    (CVE-2022-3202)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 (Double-Hash Port Selection Algorithm) of RFC 6056.
    (CVE-2022-32296)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

  - drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-     after-free if a physically proximate attacker removes a USB device while calling open(), aka a race     condition between ufx_ops_open and ufx_usb_disconnect. (CVE-2022-41849)

  - A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through     5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and     potentially execute code. (CVE-2022-42719)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3810-1 advisory.

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request     of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting     in a PCIe link disconnect. (CVE-2022-3169)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - A use-after-free flaw was found in the Linux kernel's SGI GRU driver in the way the first     gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the     gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate     their privileges on the system. (CVE-2022-3424)

  - An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a     race condition with a resultant use-after-free. (CVE-2022-40307)

  - drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information     from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
    (CVE-2022-40768)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3809-1 advisory.

  - The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to     simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI     error injection through EINJ when securelevel is set. (CVE-2016-3695)

  - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP     socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux     kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
    (CVE-2020-16119)

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request     of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting     in a PCIe link disconnect. (CVE-2022-3169)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 (Double-Hash Port Selection Algorithm) of RFC 6056.
    (CVE-2022-32296)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

  - drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information     from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
    (CVE-2022-40768)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

  - drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-     after-free if a physically proximate attacker removes a USB device while calling open(), aka a race     condition between ufx_ops_open and ufx_usb_disconnect. (CVE-2022-41849)

  - A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through     5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and     potentially execute code. (CVE-2022-42719)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3775-1 advisory.

  - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP     socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux     kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
    (CVE-2020-16119)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request     of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting     in a PCIe link disconnect. (CVE-2022-3169)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information     from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.
    (CVE-2022-40768)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

  - drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-     after-free if a physically proximate attacker removes a USB device while calling open(), aka a race     condition between ufx_ops_open and ufx_usb_disconnect. (CVE-2022-41849)

  - A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through     5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and     potentially execute code. (CVE-2022-42719)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

  - In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the     mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon     protection of P2P devices. (CVE-2022-42722)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3704-1 advisory.

  - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP     socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux     kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
    (CVE-2020-16119)

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 (Double-Hash Port Selection Algorithm) of RFC 6056.
    (CVE-2022-32296)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

  - An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could     cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. (CVE-2022-41674)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

  - drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-     after-free if a physically proximate attacker removes a USB device while calling open(), aka a race     condition between ufx_ops_open and ufx_usb_disconnect. (CVE-2022-41849)

  - A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through     5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and     potentially execute code. (CVE-2022-42719)

  - Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through     5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-     free conditions to potentially execute code. (CVE-2022-42720)

  - A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before     5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in     turn, potentially execute code. (CVE-2022-42721)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3693-1 advisory.

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. This occurs because of use of Algorithm 4 (Double-Hash Port Selection Algorithm) of RFC 6056.
    (CVE-2022-32296)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3688-1 advisory.

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3609-1 advisory.

  - The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to     simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI     error injection through EINJ when securelevel is set. (CVE-2016-3695)

  - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP     socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux     kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
    (CVE-2020-16119)

  - A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl()     printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had     been freed by gprinter_free(). (CVE-2020-27784)

  - An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the     hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session     or terminate that session. (CVE-2020-36516)

  - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size     increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS     filesystem otherwise not accessible to them. (CVE-2021-4155)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

  - In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input     validation. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-223375145References: Upstream kernel (CVE-2022-20369)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow     an authorized user to potentially enable information disclosure via local access. (CVE-2022-26373)

  - An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the     bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to     gain unauthorized access to data. (CVE-2022-2905)

  - A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where     virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-     free and create a situation where it may be possible to escalate privileges on the system. (CVE-2022-2977)

  - A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem)     when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to     potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read     and copying it into a socket. (CVE-2022-3028)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in     net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. (CVE-2022-36879)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of     service can occur upon binding to an already bound chain. (CVE-2022-39190)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is     not held during a PUD move. (CVE-2022-41222)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

  - drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-     after-free if a physically proximate attacker removes a USB device while calling open(), aka a race     condition between ufx_ops_open and ufx_usb_disconnect. (CVE-2022-41849)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3587-1 advisory.

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3584-1 advisory.

  - In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized     data. This could lead to local information disclosure if reading from an SD card that triggers errors,     with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel (CVE-2022-20008)

  - Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to     restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently     allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass     verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and     unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for     peripherals that do not verify firmware updates. We recommend upgrading past commit     4caae58406f8ceb741603eee460d79bacca9b1b5 (CVE-2022-2503)

  - An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and     incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted     IRC with nf_conntrack_irc configured. (CVE-2022-2663)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race     condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale     TLB entries. This only occurs in situations with VM_PFNMAP VMAs. (CVE-2022-39188)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3585-1 advisory.

  - A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled.
    This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a     kernel oops condition that results in a denial of service. (CVE-2022-1263)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux     kernel. This could allow a local attacker to crash the system or leak kernel internal information.
    (CVE-2022-3202)

  - A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers     em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system     or potentially escalate their privileges on the system. (CVE-2022-3239)

  - A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead     to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or     member of the audio group) could use this flaw to crash the system, resulting in a denial of service     condition (CVE-2022-3303)

  - An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users     can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED     situations. (CVE-2022-39189)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant     use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race     condition between mgslpc_ioctl and mgslpc_detach. (CVE-2022-41848)

  - drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-     after-free if a physically proximate attacker removes a USB device while calling open(), aka a race     condition between ufx_ops_open and ufx_usb_disconnect. (CVE-2022-41849)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
233768	Photon OS 5.0: Linux PHSA-2025-5.0-0491	Nessus	PhotonOS Local Security Checks	high
224944	Linux Distros Unpatched Vulnerability : CVE-2022-41848	Nessus	Misc.	medium
169292	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:4617-1)	Nessus	SuSE Local Security Checks	high
169291	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:4611-1)	Nessus	SuSE Local Security Checks	high
169289	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:4615-1)	Nessus	SuSE Local Security Checks	high
168943	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:4561-1)	Nessus	SuSE Local Security Checks	high
166793	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:3844-1)	Nessus	SuSE Local Security Checks	high
166765	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:3810-1)	Nessus	SuSE Local Security Checks	high
166751	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3809-1)	Nessus	SuSE Local Security Checks	high
166585	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2022:3775-1)	Nessus	SuSE Local Security Checks	high
166446	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3704-1)	Nessus	SuSE Local Security Checks	high
166432	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3693-1)	Nessus	SuSE Local Security Checks	high
166419	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3688-1)	Nessus	SuSE Local Security Checks	high
166257	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3609-1)	Nessus	SuSE Local Security Checks	high
166193	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2022:3587-1)	Nessus	SuSE Local Security Checks	high
166188	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:3584-1)	Nessus	SuSE Local Security Checks	high
166146	SUSE SLES15 Security Update : kernel (SUSE-SU-2022:3585-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-41848

medium

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high