There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE     operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation     won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true     as calling io_splice on specific files will call the get_uts function which will use current->nsproxy     leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We     recommend upgrading to version 5.10.160 or above (CVE-2022-4696)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0017 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-4696:
    There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE     operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation     won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true     as calling io_splice on specific files will call the get_uts function which will use current->nsproxy     leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We     recommend upgrading to version 5.10.160 or above

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote NewStart CGSL host, running version MAIN 6.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init     (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different     vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an     unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data     in net/netfilter/nf_tables_api.c. (CVE-2022-34918)

  - When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of     bounds. (CVE-2021-33655)

  - When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
    (CVE-2021-33656)

  - A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that     allows local users to create files for the XFS file-system with an unintended group ownership and with     group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a member of this group. This can lead to excessive     permissions granted in case when they should not. This vulnerability is similar to the previous     CVE-2018-13405 and adds the missed fix for the XFS. (CVE-2021-4037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could     lead to local escalation of privilege with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220738351References:
    Upstream kernel (CVE-2022-20568)

  - A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.
    L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after     running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can     execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past     commit 2e7eab81425a (CVE-2022-2196)

  - An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in     drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in     wm8350_init_charger(). (CVE-2022-3111)

  - A use-after-free flaw was found in the Linux kernel's SGI GRU driver in the way the first     gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the     gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate     their privileges on the system. (CVE-2022-3424)

  - A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card     system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could     allow a local user to crash the system. (CVE-2022-3707)

  - In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused     by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. (CVE-2022-41218)

  - A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches     usb device. A local user could use this flaw to crash the system. (CVE-2022-4662)

  - There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE     operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation     won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true     as calling io_splice on specific files will call the get_uts function which will use current->nsproxy     leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We     recommend upgrading to version 5.10.160 or above (CVE-2022-4696)

  - In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows     an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control     configuration that is set up with 'tc qdisc' and 'tc class' commands. This affects qdisc_graft in     net/sched/sch_api.c. (CVE-2022-47929)

  - An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq     in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can     be skipped. An attack can occur in some situations by forking a process and then quickly terminating it.
    NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of     io_sqpoll_wait_sq. (CVE-2022-47946)

  - A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could     allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to     the root user via arbitrary code execution. (CVE-2023-0179)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ('net: sched: fix race     condition in qdisc_graft()') not applied yet, then kernel could be affected. (CVE-2023-0590)

  - In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could     lead to local escalation of privilege with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254837884References:
    Upstream kernel (CVE-2023-20928)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3349 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3349-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Ben Hutchings     March 02, 2023                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : linux-5.10     Version        : 5.10.162-1~deb10u1     CVE ID         : CVE-2022-2873 CVE-2022-3545 CVE-2022-3623 CVE-2022-4696                      CVE-2022-36280 CVE-2022-41218 CVE-2022-45934 CVE-2022-47929                      CVE-2023-0179 CVE-2023-0240 CVE-2023-0266 CVE-2023-0394                      CVE-2023-23454  CVE-2023-23455 CVE-2023-23586     Debian Bug     : 825141 1008501 1027430 1027483

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    CVE-2022-2873

        Zheyu Ma discovered that an out-of-bounds memory access flaw in         the Intel iSMT SMBus 2.0 host controller driver may result in         denial of service (system crash).

    CVE-2022-3545

        It was discovered that the Netronome Flow Processor (NFP) driver         contained a use-after-free flaw in area_cache_get(), which may         result in denial of service or the execution of arbitrary code.

    CVE-2022-3623

        A race condition when looking up a CONT-PTE/PMD size hugetlb page         may result in denial of service or an information leak.

    CVE-2022-4696

        A use-after-free vulnerability was discovered in the io_uring         subsystem.

    CVE-2022-36280

        An out-of-bounds memory write vulnerability was discovered in the         vmwgfx driver, which may allow a local unprivileged user to cause         a denial of service (system crash).

    CVE-2022-41218

        Hyunwoo Kim reported a use-after-free flaw in the Media DVB core         subsystem caused by refcount races, which may allow a local user         to cause a denial of service or escalate privileges.

    CVE-2022-45934

        An integer overflow in l2cap_config_req() in the Bluetooth         subsystem was discovered, which may allow a physically proximate         attacker to cause a denial of service (system crash).

    CVE-2022-47929

        Frederick Lawler reported a NULL pointer dereference in the         traffic control subsystem allowing an unprivileged user to cause a         denial of service by setting up a specially crafted traffic         control configuration.

    CVE-2023-0179

        Davide Ornaghi discovered incorrect arithmetics when fetching VLAN         header bits in the netfilter subsystem, allowing a local user to         leak stack and heap addresses or potentially local privilege         escalation to root.

    CVE-2023-0240

        A flaw was discovered in the io_uring subsystem that could lead         to a use-after-free.  A local user could exploit this to cause         a denial of service (crash or memory corruption) or possibly for         privilege escalation.

    CVE-2023-0266

        A use-after-free flaw in the sound subsystem due to missing         locking may result in denial of service or privilege escalation.

    CVE-2023-0394

        Kyle Zeng discovered a NULL pointer dereference flaw in         rawv6_push_pending_frames() in the network subsystem allowing a         local user to cause a denial of service (system crash).

    CVE-2023-23454

        Kyle Zeng reported that the Class Based Queueing (CBQ) network         scheduler was prone to denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23455

        Kyle Zeng reported that the ATM Virtual Circuits (ATM) network         scheduler was prone to a denial of service due to interpreting         classification results before checking the classification return         code.

    CVE-2023-23586

        A flaw was discovered in the io_uring subsystem that could lead to         an information leak.  A local user could exploit this to obtain         sensitive information from the kernel or other users.

    For Debian 10 buster, these problems have been fixed in version     5.10.162-1~deb10u1.

    This update also fixes Debian bugs #825141, #1008501, #1027430, and     #1027483, and includes many more bug fixes from stable updates     5.10.159-5.10.162 inclusive.

    We recommend that you upgrade your linux-5.10 packages.

    For the detailed security status of linux-5.10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/linux-5.10

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5324 advisory.

    Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation,     denial of service or information leaks. CVE-2022-2873 Zheyu Ma discovered that an out-of-bounds memory     access flaw in the Intel iSMT SMBus 2.0 host controller driver may result in denial of service (system     crash). CVE-2022-3545 It was discovered that the Netronome Flow Processor (NFP) driver contained a use-     after-free flaw in area_cache_get(), which may result in denial of service or the execution of arbitrary     code. CVE-2022-3623 A race condition when looking up a CONT-PTE/PMD size hugetlb page may result in denial     of service or an information leak. CVE-2022-4696 A use-after-free vulnerability was discovered in the     io_uring subsystem. CVE-2022-36280 An out-of-bounds memory write vulnerability was discovered in the     vmwgfx driver, which may allow a local unprivileged user to cause a denial of service (system crash).
    CVE-2022-41218 Hyunwoo Kim reported a use-after-free flaw in the Media DVB core subsystem caused by     refcount races, which may allow a local user to cause a denial of service or escalate privileges.
    CVE-2022-45934 An integer overflow in l2cap_config_req() in the Bluetooth subsystem was discovered, which     may allow a physically proximate attacker to cause a denial of service (system crash). CVE-2022-47929     Frederick Lawler reported a NULL pointer dereference in the traffic control subsystem allowing an     unprivileged user to cause a denial of service by setting up a specially crafted traffic control     configuration. CVE-2023-0179 Davide Ornaghi discovered incorrect arithmetics when fetching VLAN header     bits in the netfilter subsystem, allowing a local user to leak stack and heap addresses or potentially     local privilege escalation to root. CVE-2023-0266 A use-after-free flaw in the sound subsystem due to     missing locking may result in denial of service or privilege escalation. CVE-2023-0394 Kyle Zeng     discovered a NULL pointer dereference flaw in rawv6_push_pending_frames() in the network subsystem     allowing a local user to cause a denial of service (system crash). CVE-2023-23454 Kyle Zeng reported that     the Class Based Queueing (CBQ) network scheduler was prone to denial of service due to interpreting     classification results before checking the classification return code. CVE-2023-23455 Kyle Zeng reported     that the ATM Virtual Circuits (ATM) network scheduler was prone to a denial of service due to interpreting     classification results before checking the classification return code. For the stable distribution     (bullseye), these problems have been fixed in version 5.10.162-1. We recommend that you upgrade your linux     packages. For the detailed security status of linux please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/linux

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
247207	Linux Distros Unpatched Vulnerability : CVE-2022-4696	Nessus	Misc.	Local	high
236642	Alibaba Cloud Linux 3 : 0042: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0042)	Nessus	Alibaba Cloud Linux Local Security Checks	Local	high
236017	Alibaba Cloud Linux 3 : 0017: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0017)	Nessus	Alibaba Cloud Linux Local Security Checks	Local	high
203339	Photon OS 4.0: Linux PHSA-2023-4.0-0318	Nessus	PhotonOS Local Security Checks	Local	high
187326	NewStart CGSL MAIN 6.06 : kernel Multiple Vulnerabilities (NS-SA-2023-0083)	Nessus	NewStart CGSL Local Security Checks	Local	high
176860	EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2023-2072)	Nessus	Huawei Local Security Checks	Local	high
176821	EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2023-2124)	Nessus	Huawei Local Security Checks	Local	high
175242	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-1759)	Nessus	Huawei Local Security Checks	Local	high
175236	EulerOS 2.0 SP11 : kernel (EulerOS-SA-2023-1781)	Nessus	Huawei Local Security Checks	Local	high
172079	Debian dla-3349 : linux-config-5.10 - security update	Nessus	Debian Local Security Checks	Local	high
170485	Debian DSA-5324-1 : linux - security update	Nessus	Debian Local Security Checks	Local	high
151965	Photon OS 4.0: Linux PHSA-2021-4.0-0065	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2022-4696

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high