In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsock_connect() expects that the socket could already be in the TCP_ESTABLISHED state when the connecting task wakes up with a signal pending. If this happens the socket will be in the connected table, and it is not removed when the socket state is reset. In this situation it's common for the process to retry connect(), and if the connection is successful the socket will be added to the connected table a second time, corrupting the list. Prevent this by calling vsock_remove_connected() if a signal is received while waiting for a connection. This is harmless if the socket is not in the connected table, and if it is in the table then removing it will prevent list corruption from a double add. Note for backporting: this patch requires d5afa82c977e ("vsock: correct removal of socket from the list"), which is in all current stable trees except 4.9.y.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990431 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: remove vsock from connected table when connect is interrupted by a signal

    vsock_connect() expects that the socket could already be in the     TCP_ESTABLISHED state when the connecting task wakes up with a signal     pending. If this happens the socket will be in the connected table, and     it is not removed when the socket state is reset. In this situation it's     common for the process to retry connect(), and if the connection is     successful the socket will be added to the connected table a second     time, corrupting the list.

    Prevent this by calling vsock_remove_connected() if a signal is received     while waiting for a connection. This is harmless if the socket is not in     the connected table, and if it is in the table then removing it will     prevent list corruption from a double add.

    Note for backporting: this patch requires d5afa82c977e (vsock: correct     removal of socket from the list), which is in all current stable trees     except 4.9.y.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990056 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: remove vsock from connected table when connect is interrupted by a signal

    vsock_connect() expects that the socket could already be in the     TCP_ESTABLISHED state when the connecting task wakes up with a signal     pending. If this happens the socket will be in the connected table, and     it is not removed when the socket state is reset. In this situation it's     common for the process to retry connect(), and if the connection is     successful the socket will be added to the connected table a second     time, corrupting the list.

    Prevent this by calling vsock_remove_connected() if a signal is received     while waiting for a connection. This is harmless if the socket is not in     the connected table, and if it is in the table then removing it will     prevent list corruption from a double add.

    Note for backporting: this patch requires d5afa82c977e (vsock: correct     removal of socket from the list), which is in all current stable trees     except 4.9.y.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987569 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: remove vsock from connected table when connect is interrupted by a signal

    vsock_connect() expects that the socket could already be in the     TCP_ESTABLISHED state when the connecting task wakes up with a signal     pending. If this happens the socket will be in the connected table, and     it is not removed when the socket state is reset. In this situation it's     common for the process to retry connect(), and if the connection is     successful the socket will be added to the connected table a second     time, corrupting the list.

    Prevent this by calling vsock_remove_connected() if a signal is received     while waiting for a connection. This is harmless if the socket is not in     the connected table, and if it is in the table then removing it will     prevent list corruption from a double add.

    Note for backporting: this patch requires d5afa82c977e (vsock: correct     removal of socket from the list), which is in all current stable trees     except 4.9.y.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vsock: remove vsock from connected table when connect is interrupted by a signal vsock_connect() expects     that the socket could already be in the TCP_ESTABLISHED state when the connecting task wakes up with a     signal pending. If this happens the socket will be in the connected table, and it is not removed when the     socket state is reset. In this situation it's common for the process to retry connect(), and if the     connection is successful the socket will be added to the connected table a second time, corrupting the     list. Prevent this by calling vsock_remove_connected() if a signal is received while waiting for a     connection. This is harmless if the socket is not in the connected table, and if it is in the table then     removing it will prevent list corruption from a double add. Note for backporting: this patch requires     d5afa82c977e (vsock: correct removal of socket from the list), which is in all current stable trees     except 4.9.y. (CVE-2022-48786)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:10273 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: vsock: remove vsock from connected table when connect is interrupted by a signal     (CVE-2022-48786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6991 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

    * kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs     (CVE-2021-47393)

    * kernel: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() (CVE-2021-47559)

    * kernel: ACPICA: Revert ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.
    (CVE-2024-40984)

    * kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995)

    * kernel: powerpc/fixmap: Fix VM debug warning on unmap (CVE-2021-47623)

    * kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)

    * kernel: vsock: remove vsock from connected table when connect is interrupted by a signal     (CVE-2022-48786)

    * kernel: perf: Fix list corruption in perf_cgroup_switch() (CVE-2022-48799)

    * kernel: SUNRPC: lock against ->sock changing during sysfs read (CVE-2022-48816)

    * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055)

    * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6990 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

    * kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs     (CVE-2021-47393)

    * kernel: net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() (CVE-2021-47559)

    * kernel: ACPICA: Revert ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.
    (CVE-2024-40984)

    * kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995)

    * kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)

    * kernel: vsock: remove vsock from connected table when connect is interrupted by a signal     (CVE-2022-48786)

    * kernel: perf: Fix list corruption in perf_cgroup_switch() (CVE-2022-48799)

    * kernel: SUNRPC: lock against ->sock changing during sysfs read (CVE-2022-48816)

    * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055)

    * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3251-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-35965: Fix not validating setsockopt user input (bsc#1224579).
    - CVE-2024-35933: Fixed build regression (bsc#1224640).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2024-43863: Fix a deadlock in dma buf fence polling (bsc#1229497)
    - CVE-2024-41087: Fix double free on error (bsc#1228466).
    - CVE-2024-43907: Fix the null pointer dereference in apply_state_adjust_rules (bsc#1229787).
    - CVE-2024-43905: Fix the null pointer dereference for vega10_hwmgr (bsc#1229784).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2022-48910: Ensure we call ipv6_mc_down() at most once (bsc#1229632)
    - CVE-2023-52893: Fix null-deref in gsmi_get_variable (bsc#1229535)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2022-48875: Initialize struct pn533_out_arg properly (bsc#1229516).
    - CVE-2023-52907: Wait for out_urb's completion in pn533_usb_send_frame() (bsc#1229526).
    - CVE-2024-43871: Fix memory leakage caused by driver API devm_free_percpu() (bsc#1229490)
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-43872: Fix soft lockup under heavy CEQE load (bsc#1229489)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB     (bsc#1228709).
    - CVE-2024-42236: Prevent OOB read/write in usb_string_copy() (bsc#1228964).
    - CVE-2024-42244: Fix crash on resume (bsc#1228967).
    - CVE-2024-43879: Handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (bsc#1229482).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-41012: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290).
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727).
    - CVE-2021-47341: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio (bsc#1224923).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2022-48769: Avoid EFIv2 runtime services on Apple x86 machines (bsc#1226629).
    - CVE-2024-43856: Fix call order in dmam_free_coherent (bsc#1229346).
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-40984: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.' (bsc#1227820).
    - CVE-2024-26677: Blacklist e7870cf13d20 (' Fix delayed ACKs to not set the reference serial number')     (bsc#1222387)
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-42310: Fix null pointer dereference in cdv_intel_lvds_get_modes (bsc#1229358)
    - CVE-2024-42309: Fix null pointer dereference in psb_intel_lvds_get_modes (bsc#1229359)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42285: Fix a use-after-free related to destroying CM IDs (bsc#1229381)
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-38618: Set lower bound of start tick time (bsc#1226754).
    - CVE-2024-41035: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (bsc#1228485)
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2023-52708: Fix error handling in mmc_spi_probe() (bsc#1225483).
    - CVE-2021-47549: Fix UAF in sata_fsl_port_stop when rmmod sata_fsl (bsc#1225508).
    - CVE-2021-47373: Fix potential VPE leak on error (bsc#1225190).
    - CVE-2021-47425: Fix resource leak in reconfiguration device addition (bsc#1225223).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-41098: Fix null pointer dereference on error (bsc#1228467).
    - CVE-2021-4440: Drop USERGS_SYSRET64 paravirt call ( bsc#1227069).
    - CVE-2022-48786: Remove vsock from connected table when connect is interrupted by a signal (bsc#1227996).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-35915: Fix uninit-value in nci_dev_up and nci_ntf_packet (bsc#1224479).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-42090: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (bsc#1228449).
    - CVE-2024-42101: Fix null pointer dereference in nouveau_connector_get_modes (bsc#1228495).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2021-47257: fix null deref in parse dev addr (bsc#1224896).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3252-1 advisory.

    The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2024-35965: Fix not validating setsockopt user input (bsc#1224579).
    - CVE-2024-35933: Fixed a build regression (bsc#1224640).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).
    - CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2024-43863: Fix a deadlock in dma buf fence polling (bsc#1229497)
    - CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
    - CVE-2024-43907: Fix the null pointer dereference in apply_state_adjust_rules (bsc#1229787).
    - CVE-2024-43905: Fix the null pointer dereference for vega10_hwmgr (bsc#1229784).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2024-26812: Struct virqfd kABI workaround (bsc#1222808).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43866: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2022-48910: Ensure we call ipv6_mc_down() at most once (bsc#1229632)
    - CVE-2023-52893: Fix null-deref in gsmi_get_variable (bsc#1229535)
    - CVE-2024-42155: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2022-48875: Initialize struct pn533_out_arg properly (bsc#1229516).
    - CVE-2023-52907: Wait for out_urb's completion in pn533_usb_send_frame() (bsc#1229526).
    - CVE-2024-43871: Fix memory leakage caused by driver API devm_free_percpu() (bsc#1229490)
    - CVE-2024-42158: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-43872: Fix soft lockup under heavy CEQE load (bsc#1229489)
    - CVE-2024-39489: Fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2024-42226: Prevent potential failure in handle_tx_event() for Transfer events without TRB     (bsc#1228709).
    - CVE-2024-42236: Prevent OOB read/write in usb_string_copy() (bsc#1228964).
    - CVE-2024-42244: Fix crash on resume (bsc#1228967).
    - CVE-2024-43879: Handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (bsc#1229482).
    - CVE-2024-27011: Fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-41020: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-41012: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
    - CVE-2024-26668: Reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
    - CVE-2024-42157: Wipe sensitive data on failure (bsc#1228727 CVE-2024-42157 git-fixes).
    - CVE-2021-47341: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio (bsc#1224923).
    - CVE-2024-43839: Adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2022-48769: Avoid EFIv2 runtime services on Apple x86 machines (bsc#1226629).
    - CVE-2024-43856: Fix call order in dmam_free_coherent (bsc#1229346).
    - CVE-2024-36286: Acquire rcu_read_lock() in instance_destroy_rcu() (bsc#1226801)
    - CVE-2024-26851: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-40984: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.' (bsc#1227820).
    - CVE-2024-26677: Blacklist e7870cf13d20 ('rxrpc: Fix delayed ACKs to not set the reference serial     number') (bsc#1222387)
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42284: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42312: Always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-42310: Fix null pointer dereference in cdv_intel_lvds_get_modes (bsc#1229358)
    - CVE-2024-42309: Fix null pointer dereference in psb_intel_lvds_get_modes (bsc#1229359)
    - CVE-2024-43854: Initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-42322: Properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42301: Fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42285: Fix a use-after-free related to destroying CM IDs (bsc#1229381)
    - CVE-2024-43831: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-42281: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-38618: Set lower bound of start tick time (bsc#1226754).
    - CVE-2024-41035: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (bsc#1228485)
    - CVE-2024-42162: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2023-52708: Fix error handling in mmc_spi_probe() (bsc#1225483).
    - CVE-2021-47549: Fix UAF in sata_fsl_port_stop when rmmod sata_fsl (bsc#1225508).
    - CVE-2021-47373: Fix potential VPE leak on error (bsc#1225190).
    - CVE-2021-47425: Fix resource leak in reconfiguration device addition (bsc#1225223).
    - CVE-2024-42246: Remap EPERM in case of connection failure in xs_tcp_setup_socket (bsc#1228989).
    - CVE-2024-41098: Fix null pointer dereference on error (bsc#1228467).
    - CVE-2021-4440: Drop USERGS_SYSRET64 paravirt call (bsc#1227069).
    - CVE-2022-48786: Remove vsock from connected table when connect is interrupted by a signal (bsc#1227996).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-35915: Fix uninit-value in nci_dev_up and nci_ntf_packet (git-fixes CVE-2024-35915     bsc#1224479).
    - CVE-2024-38662: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-42110: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (bsc#1228501).
    - CVE-2024-42148: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42106: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2024-41068: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2024-42082: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-42090: Fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (bsc#1228449).
    - CVE-2024-42101: Fix null pointer dereference in nouveau_connector_get_modes (bsc#1228495).
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2021-47257: Fix null deref in parse dev addr (bsc#1224896).
    - CVE-2022-48751: Transitional solution for clcsock race issue (bsc#1226653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    kernel:ACPI: CPPC: Use access_width over bit_width for system memory accesses(CVE-2024-35995)

    kernel: block: fix overflow in blk_ioctl_discard()(CVE-2024-36917)

    kernel:block: prevent division by zero in blk_rq_stat_sum()(CVE-2024-35925)

    bpf: Fix stackmap overflow check on 32-bit arches(CVE-2024-26883)

    kernel:calipso: fix memory leak in netlbl_calipso_add_pass()(CVE-2023-52698)

    kernel:erspan: make sure erspan_base_hdr is present in skb-head(CVE-2024-35888)

    kernel: ext4: fix corruption during on-line resize(CVE-2024-35807)

    kernel:HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up(CVE-2024-35997)

    HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect(CVE-2023-52478)

    kernel:i2c: smbus: fix NULL function pointer dereference(CVE-2024-35984)

    kernel:i40e: Do not use WQ_MEM_RECLAIM flag for workqueue(CVE-2024-36004)

    i40e: Fix NULL ptr dereference on VSI filter sync(CVE-2021-47184)

    iavf: free q_vectors before queues in iavf_disable_vf(CVE-2021-47201)

    ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()(CVE-2024-26633)

    ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()(CVE-2024-26641)

    kernel:ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()(CVE-2024-36902)

    kernel:ipv6: Fix infinite recursion in fib6_dump_done().(CVE-2024-35886)

    kernel:ipv6: Fix potential uninit-value access in __ip6_make_skb()(CVE-2024-36903)

    kernel:ipv6: prevent NULL dereference in ip6_output()(CVE-2024-36901)

    kernel:ipvlan: add ipvlan_route_v6_outbound() helper(CVE-2023-52796)

    kernel:irqchip/gic-v3-its: Prevent double free on error(CVE-2024-35847)

    kernel: md/dm-raid: don#39;t call md_reap_sync_thread() directly(CVE-2024-35808)

    kernel:net/mlx5: Properly link new fs rules into the tree(CVE-2024-35960)

    kernel:net/mlx5e: fix a double-free in arfs_create_groups(CVE-2024-35835)

    kernel:net: fix __dst_negative_advice() race(CVE-2024-36971)

    kernel:net: fix out-of-bounds access in ops_init(CVE-2024-36883)

    kernel:netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()(CVE-2024-27020)

    kernel:netfilter: validate user input for expected length(CVE-2024-35896)

    NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds(CVE-2021-46952)

    kernel:nvme-fc: do not wait in vain when unloading module(CVE-2024-26846)

    nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells(CVE-2021-47497)

    kernel: PCI/PM: Drain runtime-idle callbacks before driver removal(CVE-2024-35809)

    kernel: perf/core: Bail out early if the request AUX area is out of bound(CVE-2023-52835)

    kernel: pinctrl: core: delete incorrect free in pinctrl_enable()(CVE-2024-36940)

    kernel:dm: call the resume method on internal suspend(CVE-2024-26880)

    kernel:RDMA: Verify port when creating flow rule(CVE-2021-47265)

    kernel:ring-buffer: Fix a race between readers and resize checks(CVE-2024-38601)

    kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload(CVE-2024-36919)

    kernel:scsi: iscsi: Fix iscsi_task use after free(CVE-2021-47427)

    kernel:scsi: lpfc: Fix link down processing to address NULL pointer dereference(CVE-2021-47183)

    kernel:scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()(CVE-2024-36924)

    kernel: scsi: mpt3sas: Fix use-after-free warning(CVE-2022-48695)

    kernel: selinux: avoid dereference of garbage after mount failure(CVE-2024-35904)

    kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()(CVE-2023-52752)

    kernel:spi: Fix deadlock when adding SPI controllers on SPI buses(CVE-2021-47469)

    kernel:SUNRPC: fix a memleak in gss_import_v2_context(CVE-2023-52653)

    kernel:tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets(CVE-2024-36905)

    kernel:tcp: properly terminate timers for kernel sockets(CVE-2024-35910)

    kernel:tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().(CVE-2024-36904)

    kernel: thermal: core: prevent potential string overflow(CVE-2023-52868)

    tty: Fix out-of-bound vmalloc access in imageblit(CVE-2021-47383)

    kernel:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()(CVE-2024-36016)

    kernel:vt: fix unicode buffer corruption when deleting characters(CVE-2024-35823)

    kernel:llc: verify mac len before reading mac header(CVE-2023-52843)

    kernel:SUNRPC: fix some memleaks in gssx_dec_option_array(CVE-2024-27388)

    kernel:net: cdc_eem: fix tx fixup skb leak(CVE-2021-47236)

    NFS: Fix use-after-free in nfs4_init_client()(CVE-2021-47259)

    kernel: IB/mlx5: Fix initializing CQ fragments buffer(CVE-2021-47261)

    kernel:kvm: avoid speculation-based attacks from out-of-range memslot accesses(CVE-2021-47277)

    kernel: drm: Fix use-after-free read in drm_getunique()(CVE-2021-47280)

    net/sched: act_skbmod: Skip non-Ethernet packets(CVE-2021-47293)

    kernel:igb: Fix use-after-free error during reset(CVE-2021-47301)

    kernel:net: qcom/emac: fix UAF in emac_remove(CVE-2021-47311)

    kernel:scsi: megaraid_sas: Fix resource leak in case of probe failure(CVE-2021-47329)

    kernel: udf: Fix NULL pointer dereference in udf_symlink function(CVE-2021-47353)

    kernel: drm/sched: Avoid data corruptions(CVE-2021-47354)

    irqchip/gic-v3-its: Fix potential VPE leak on error(CVE-2021-47373)

    kernel:sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb(CVE-2021-47397)

    kernel: netfilter: conntrack: serialize hash resizes and cleanups(CVE-2021-47408)

    phy: mdio: fix memory leak(CVE-2021-47416)

    i40e: Fix freeing of uninitialized misc IRQ vector(CVE-2021-47424)

    kernel:i2c: acpi: fix resource leak in reconfiguration device addition(CVE-2021-47425)

    kernel: dm: fix mempool NULL pointer race when completing IO(CVE-2021-47435)

    kernel:net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path(CVE-2021-47438)

    kernel:ptp: Fix possible memory leak in ptp_clock_register()(CVE-2021-47455)

    kernel: mm, slub: fix potential memoryleak in kmem_cache_open()(CVE-2021-47466)

    kernel: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()(CVE-2021-47473)

    kernel: isofs: Fix out of bound access for corrupted isofs image(CVE-2021-47478)

    kernel: scsi: core: Put LLD module refcnt after SCSI device is released(CVE-2021-47480)

    kernel:regmap: Fix possible double-free in regcache_rbtree_exit()(CVE-2021-47483)

    kernel:usbnet: sanity check for maxpacket(CVE-2021-47495)

    kernel:i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc(CVE-2021-47501)

    kernel:nfp: Fix memory leak in nfp_cpp_area_cache_add()(CVE-2021-47516)

    serial: core: fix transmit-buffer reset and memleak(CVE-2021-47527)

    kernel:net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()(CVE-2021-47541)

    tcp: fix page frag corruption on page fault(CVE-2021-47544)

    kernel:ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in     hns_dsaf_ge_srst_by_port()(CVE-2021-47548)

    kernel: scsi: mpt3sas: Fix kernel panic during drive powercycle test(CVE-2021-47565)

    proc/vmcore: fix clearing user buffer by properly using clear_user()(CVE-2021-47566)

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()(CVE-2021-47576)

    ovl: fix warning in ovl_create_real()(CVE-2021-47579)

    sit: do not call ipip6_dev_free() from sit_init_net()(CVE-2021-47588)

    igbvf: fix double free in `igbvf_probe`(CVE-2021-47589)

    kernel:inet_diag: fix kernel-infoleak for UDP sockets(CVE-2021-47597)

    net: netlink: af_netlink: Prevent empty skb by adding a check on len.(CVE-2021-47606)

    kernel:firmware: arm_scpi: Fix string overflow in SCPI genpd driver(CVE-2021-47609)

    kernel:i40e: Fix queues reservation for XDP(CVE-2021-47619)

    kernel: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe(CVE-2022-48715)

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()(CVE-2022-48742)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    phylib: fix potential use-after-free(CVE-2022-48754)

    vsock: remove vsock from connected table when connect is interrupted by a signal(CVE-2022-48786)

    perf: Fix list corruption in perf_cgroup_switch()(CVE-2022-48799)

    kernel:vt_ioctl: fix array_index_nospec in vt_setactivate(CVE-2022-48804)

    net: fix a memleak when uncloning an skb dst and its metadata(CVE-2022-48809)

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path(CVE-2022-48810)

    kernel:sctp: fix kernel-infoleak for SCTP sockets(CVE-2022-48855)

    kernel:of: Fix double free in of_parse_phandle_with_args_map(CVE-2023-52679)

    kernel:net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path(CVE-2023-52703)

    kernel: mmc: mmc_spi: fix error handling in mmc_spi_probe()(CVE-2023-52708)

    kernel: Fix page corruption caused by racy check in __free_pages(CVE-2023-52739)

    kernel:SUNRPC: Fix RPC client cleaned up the freed pipefs dentries(CVE-2023-52803)

    kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET(CVE-2023-52813)

    kernel:tcp: do not accept ACK of bytes we never sent(CVE-2023-52881)

    kernel:nouveau: lock the client object tree. (CVE-2024-27062)

    kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes(CVE-2024-35789)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    kernel: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion(CVE-2024-35815)

    kernel: fbmon: prevent division by zero in fb_videomode_from_videomode()(CVE-2024-35922)

    kernel:scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()  (CVE-2024-35930)

    kernel:kprobes: Fix possible use-after-free issue on kprobe registration(CVE-2024-35955)

    kernel:netfilter: complete validation of user input(CVE-2024-35962)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up(CVE-2024-36952)

    kernel:virtio: delete vq in vp_find_vqs_msix() when request_irq() fails(CVE-2024-37353)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    kernel:of: module: add buffer overflow check in of_modalias()(CVE-2024-38541)

    kernel:scsi: qedf: Ensure the copied buf is NUL terminated(CVE-2024-38559)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel: ext4: fix mb_cache_entry#39;s e_refcnt leak in ext4_xattr_block_cache_find()CVE-2024-39276)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    kernel:USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages(CVE-2024-40904)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    kernel:ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.(CVE-2024-40984)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:ext4: fix uninitialized ratelimit_state-lock access in __ext4_fill_super()(CVE-2024-40998)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    kernel:ACPI: CPPC: Use access_width over bit_width for system memory accesses(CVE-2024-35995)

    ACPI: LPIT: Avoid u32 multiplication overflow(CVE-2023-52683)

    ACPI: video: check for error while searching for backlight device parent(CVE-2023-52693)

    bpf: Fix stackmap overflow check on 32-bit arches(CVE-2024-36949)

    kernel: block: fix overflow in blk_ioctl_discard()(CVE-2024-36917)

    kernel:block: prevent division by zero in blk_rq_stat_sum()(CVE-2024-35925)

    bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue(CVE-2024-36938)

    bpf, sockmap: Prevent lock inversion deadlock in map delete elem(CVE-2024-35895)

    kernel:calipso: fix memory leak in netlbl_calipso_add_pass()(CVE-2023-52698)

    drm/amd/display: Avoid NULL dereference of timing generator(CVE-2023-52753)

    drm/amd/display: Skip on writeback when it's not applicable(CVE-2024-36914)

    kernel:erspan: make sure erspan_base_hdr is present in skb-head(CVE-2024-35888)

    kernel: ext4: fix corruption during on-line resize(CVE-2024-35807)

    kernel: ext4: fix possible UAF when remounting r/o a mmp-protected file system(CVE-2021-47342)

    firewire: ohci: mask bus reset interrupts between ISR and bottom half(CVE-2024-36950)

    gfs2: ignore negated quota changes(CVE-2023-52759)

    kernel:HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up(CVE-2024-35997)

    kernel:i2c: smbus: fix NULL function pointer dereference(CVE-2024-35984)

    kernel:i40e: Do not use WQ_MEM_RECLAIM flag for workqueue(CVE-2024-36004)

    kernel:ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()(CVE-2024-36902)

    kernel:ipv6: Fix infinite recursion in fib6_dump_done().(CVE-2024-35886)

    kernel:ipv6: prevent NULL dereference in ip6_output()(CVE-2024-36901)

    kernel:ipvlan: add ipvlan_route_v6_outbound() helper(CVE-2023-52796)

    kernel: md/dm-raid: don#39;t call md_reap_sync_thread() directly(CVE-2024-35808)

    media: bttv: fix use after free error due to btv-timeout timer(CVE-2023-52847)

    media: gspca: cpia1: shift-out-of-bounds in set_flicker(CVE-2023-52764)

    mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update(CVE-2024-35855)

    mlxsw: spectrum_acl_tcam: Fix warning during rehash(CVE-2024-36007)

    kernel:net/mlx5: Properly link new fs rules into the tree(CVE-2024-35960)

    kernel:net/mlx5e: fix a double-free in arfs_create_groups(CVE-2024-35835)

    kernel:net: fix __dst_negative_advice() race(CVE-2024-36971)

    kernel:net: fix out-of-bounds access in ops_init(CVE-2024-36883)

    kernel:netfilter: validate user input for expected length(CVE-2024-35896)

    NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds(CVE-2021-46952)

    nsh: Restore skb-{protocol,data,mac_header} for outer header in nsh_gso_segment().(CVE-2024-36933)

    nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells(CVE-2021-47497)

    kernel: PCI/PM: Drain runtime-idle callbacks before driver removal(CVE-2024-35809)

    kernel: pinctrl: core: delete incorrect free in pinctrl_enable()(CVE-2024-36940)

    platform/x86: wmi: Fix opening of char device(CVE-2023-52864)

    ppdev: Add an error check in register_device(CVE-2024-36015)

    kernel:RDMA: Verify port when creating flow rule(CVE-2021-47265)

    kernel:ring-buffer: Fix a race between readers and resize checks(CVE-2024-38601)

    kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload(CVE-2024-36919)

    kernel:scsi: iscsi: Fix iscsi_task use after free(CVE-2021-47427)

    kernel:scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()(CVE-2024-36924)

    kernel: selinux: avoid dereference of garbage after mount failure(CVE-2024-35904)

    kernel: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()(CVE-2023-52752)

    kernel:tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets(CVE-2024-36905)

    kernel:tcp: properly terminate timers for kernel sockets(CVE-2024-35910)

    kernel:tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().(CVE-2024-36904)

    kernel: thermal: core: prevent potential string overflow(CVE-2023-52868)

    tipc: fix a possible memleak in tipc_buf_append(CVE-2024-36954)

    tipc: fix UAF in error path(CVE-2024-36886)

    kernel:tty: n_gsm: fix possible out-of-bounds in gsm0_receive()(CVE-2024-36016)

    virtio-blk: fix implicit overflow on virtio_max_dma_size(CVE-2023-52762)

    wifi: mac80211: don't return unset power in ieee80211_get_tx_power()(CVE-2023-52832)

    kernel:llc: verify mac len before reading mac header(CVE-2023-52843)

    x86/mm/pat: fix VM_PAT handling in COW mappings(CVE-2024-35877)

    drm/client: Fully protect modes[] with dev-mode_config.mutex(CVE-2024-35950)

    mlxsw: spectrum_acl_tcam: Fix incorrect list API usage(CVE-2024-36006)

    net: bridge: fix vlan tunnel dst refcnt when egressing(CVE-2021-47222)

    net: bridge: fix vlan tunnel dst null pointer dereference(CVE-2021-47223)

    KVM: x86: Immediately reset the MMU context when the SMM flag is cleared(CVE-2021-47230)

    kernel:net: cdc_eem: fix tx fixup skb leak(CVE-2021-47236)

    net: ipv4: fix memory leak in ip_mc_add1_src(CVE-2021-47238)

    netfilter: synproxy: Fix out of bounds when parsing TCP options(CVE-2021-47245)

    udp: fix race between close() and udp_abort()(CVE-2021-47248)

    net: ipv4: fix memory leak in netlbl_cipsov4_add_std(CVE-2021-47250)

    kvm: LAPIC: Restore guard to prevent illegal APIC register access(CVE-2021-47255)

    NFS: Fix use-after-free in nfs4_init_client()(CVE-2021-47259)

    kernel: IB/mlx5: Fix initializing CQ fragments buffer(CVE-2021-47261)

    ftrace: Do not blindly read the ip address in ftrace_bug()(CVE-2021-47276)

    kernel:kvm: avoid speculation-based attacks from out-of-range memslot accesses(CVE-2021-47277)

    kernel: drm: Fix use-after-free read in drm_getunique()(CVE-2021-47280)

    isdn: mISDN: netjet: Fix crash in nj_probe(CVE-2021-47284)

    media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()(CVE-2021-47288)

    net/sched: act_skbmod: Skip non-Ethernet packets(CVE-2021-47293)

    kernel:igb: Fix use-after-free error during reset(CVE-2021-47301)

    igc: Fix use-after-free error during reset(CVE-2021-47302)

    scsi: libfc: Fix array index out of bound exception(CVE-2021-47308)

    virtio-blk: Fix memory leak among suspend/resume procedure(CVE-2021-47319)

    scsi: iscsi: Fix conn use after free during resets(CVE-2021-47328)

    kernel:scsi: megaraid_sas: Fix resource leak in case of probe failure(CVE-2021-47329)

    KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio(CVE-2021-47341)

    kernel: udf: Fix NULL pointer dereference in udf_symlink function(CVE-2021-47353)

    bpf: Add oversize check before call kvcalloc()(CVE-2021-47376)

    mac80211: limit injected vht mcs     ss in ieee80211_parse_tx_radiotap(CVE-2021-47395)

    kernel:sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb(CVE-2021-47397)

    ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup(CVE-2021-47399)

    HID: usbhid: free raw_report buffers in usbhid_stop(CVE-2021-47405)

    KVM: x86: Handle SRCU initialization failure during page track init(CVE-2021-47407)

    phy: mdio: fix memory leak(CVE-2021-47416)

    net_sched: fix NULL deref in fifo_set_limit()(CVE-2021-47418)

    i40e: Fix freeing of uninitialized misc IRQ vector(CVE-2021-47424)

    kernel:i2c: acpi: fix resource leak in reconfiguration device addition(CVE-2021-47425)

    xhci: Fix command ring pointer corruption while aborting a command(CVE-2021-47434)

    kernel:net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path(CVE-2021-47438)

    can: peak_pci: peak_pci_remove(): fix UAF(CVE-2021-47456)

    audit: fix possible null-pointer dereference in audit_filter_rules(CVE-2021-47464)

    kernel: mm, slub: fix potential memoryleak in kmem_cache_open()(CVE-2021-47466)

    isdn: mISDN: Fix sleeping function called from invalid context(CVE-2021-47468)

    kernel: scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()(CVE-2021-47473)

    kernel: isofs: Fix out of bound access for corrupted isofs image(CVE-2021-47478)

    kernel:regmap: Fix possible double-free in regcache_rbtree_exit()(CVE-2021-47483)

    kernel:usbnet: sanity check for maxpacket(CVE-2021-47495)

    net/tls: Fix flipped sign in tls_err_abort() calls(CVE-2021-47496)

    kernel:i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc(CVE-2021-47501)

    ALSA: pcm: oss: Fix negative period/buffer sizes(CVE-2021-47511)

    kernel:nfp: Fix memory leak in nfp_cpp_area_cache_add()(CVE-2021-47516)

    serial: core: fix transmit-buffer reset and memleak(CVE-2021-47527)

    kernel:net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()(CVE-2021-47541)

    tcp: fix page frag corruption on page fault(CVE-2021-47544)

    kernel: scsi: mpt3sas: Fix kernel panic during drive powercycle test(CVE-2021-47565)

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()(CVE-2021-47576)

    ovl: fix warning in ovl_create_real()(CVE-2021-47579)

    media: mxl111sf: change mutex_init() location(CVE-2021-47583)

    sit: do not call ipip6_dev_free() from sit_init_net()(CVE-2021-47588)

    igbvf: fix double free in `igbvf_probe`(CVE-2021-47589)

    kernel:inet_diag: fix kernel-infoleak for UDP sockets(CVE-2021-47597)

    mac80211: track only QoS data frames for admission control(CVE-2021-47602)

    net: netlink: af_netlink: Prevent empty skb by adding a check on len.(CVE-2021-47606)

    PCI: pciehp: Fix infinite loop in IRQ handler upon power fault(CVE-2021-47617)

    kernel:i40e: Fix queues reservation for XDP(CVE-2021-47619)

    kernel: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe(CVE-2022-48715)

    drm     ouveau: fix off by one in BIOS boundary checking(CVE-2022-48732)

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()(CVE-2022-48742)

    net: amd-xgbe: Fix skb data length underflow(CVE-2022-48743)

    kernel:net/mlx5e: Avoid field-overflowing memcpy()(CVE-2022-48744)

    kernel:block: Fix wrong offset in bio_truncate()(CVE-2022-48747)

    phylib: fix potential use-after-free(CVE-2022-48754)

    net: fix information leakage in /proc/net/ptype(CVE-2022-48757)

    scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()(CVE-2022-48758)

    USB: core: Fix hang in usb_kill_urb by adding memory barriers(CVE-2022-48760)

    media: lgdt3306a: Add a check against null-pointer-def(CVE-2022-48772)

    Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj(CVE-2022-48775)

    vsock: remove vsock from connected table when connect is interrupted by a signal(CVE-2022-48786)

    nvme-rdma: fix possible use-after-free in transport error_recovery work(CVE-2022-48788)

    nvme-tcp: fix possible use-after-free in transport error_recovery work(CVE-2022-48789)

    nvme: fix a possible use-after-free in controller reset during load(CVE-2022-48790)

    kernel:vt_ioctl: fix array_index_nospec in vt_setactivate(CVE-2022-48804)

    net: fix a memleak when uncloning an skb dst and its metadata(CVE-2022-48809)

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path(CVE-2022-48810)

    scsi: qedf: Fix refcount issue when LOGO is received during TMF(CVE-2022-48823)

    NFSD: Fix ia_size underflow(CVE-2022-48828)

    Input: aiptek - properly check endpoint type(CVE-2022-48836)

    net/packet: fix slab-out-of-bounds access in packet_recvmsg()(CVE-2022-48839)

    drm/vrr: Set VRR capable prop only if it is attached to connector(CVE-2022-48843)

    net-sysfs: add check for netdevice being present to speed_show(CVE-2022-48850)

    kernel:sctp: fix kernel-infoleak for SCTP sockets(CVE-2022-48855)

    tipc: fix kernel panic when enabling bearer(CVE-2022-48865)

    The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in     the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local     access, this 'could be exploited in a real world scenario.' This is related to     brcmf_cfg80211_escan_timeout_worker in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.(CVE-2023-47233)

    kernel:net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path(CVE-2023-52703)

    sched/psi: Fix use-after-free in ep_remove_wait_queue()(CVE-2023-52707)

    mmc: sdio: fix possible resource leaks in some error paths(CVE-2023-52730)

    cifs: Fix use-after-free in rdata-read_into_pages()(CVE-2023-52741)

    IB/hfi1: Restore allocated resources on failed copyout(CVE-2023-52747)

    media: imon: fix access to invalid resource for the second interface(CVE-2023-52754)

    kernel:SUNRPC: Fix RPC client cleaned up the freed pipefs dentries(CVE-2023-52803)

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()(CVE-2023-52809)

    kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET(CVE-2023-52813)

    atl1c: Work around the DMA RX overflow issue(CVE-2023-52834)

    tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING(CVE-2023-52845)

    tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc(CVE-2023-52880)

    kernel:tcp: do not accept ACK of bytes we never sent(CVE-2023-52881)

    A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious     actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL     pointer dereference in the NVMe driver, causing kernel panic and a denial of service.(CVE-2023-6536)

    In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to     drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.(CVE-2024-23848)

    A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function.
    This can result in a bluetooth sniffing exception issue, possibly leading denial of     service.(CVE-2024-24859)

    ipv6: fix potential 'struct net' leak in inet6_rtm_getaddr()(CVE-2024-27417)

    genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline(CVE-2024-31076)

    ipvlan: Dont Use skb-sk in ipvlan_process_v{4,6}_outbound(CVE-2024-33621)

    kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes(CVE-2024-35789)

    kernel:fix lockup in dm_exception_table_exit  There was reported lockup(CVE-2024-35805)

    wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach(CVE-2024-35811)

    mlxsw: spectrum_acl_tcam: Fix memory leak during rehash(CVE-2024-35853)

    net/sched: act_skbmod: prevent kernel-infoleak(CVE-2024-35893)

    netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()(CVE-2024-35898)

    kernel:scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()  (CVE-2024-35930)

    dyndbg: fix old BUG_ON in control parser(CVE-2024-35947)

    kernel:netfilter: complete validation of user input(CVE-2024-35962)

    kernel:ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr(CVE-2024-35969)

    xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING(CVE-2024-35976)

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation(CVE-2024-36017)

    netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()(CVE-2024-36286)

    wifi: nl80211: don't free NULL coalescing rule(CVE-2024-36941)

    kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up(CVE-2024-36952)

    drm/vmwgfx: Fix invalid reads in fence signaled events(CVE-2024-36960)

    kernel:virtio: delete vq in vp_find_vqs_msix() when request_irq() fails(CVE-2024-37353)

    kernel:tcp: Fix shift-out-of-bounds in dctcp_update_alpha().(CVE-2024-37356)

    kernel:net: bridge: xmit: make sure we have at least eth header len bytes(CVE-2024-38538)

    drm/amd/display: Fix potential index out of bounds in color transformation function(CVE-2024-38552)

    net: openvswitch: fix overwriting ct original tuple for ICMPv6(CVE-2024-38558)

    kernel:scsi: qedf: Ensure the copied buf is NUL terminated(CVE-2024-38559)

    kernel:ftrace: Fix possible use-after-free issue in ftrace_location()(CVE-2024-38588)

    kernel:af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg(CVE-2024-38596)

    kernel: ext4: fix mb_cache_entry#39;s e_refcnt leak in ext4_xattr_block_cache_find()(CVE-2024-39276)

    kernel:kdb: Fix buffer overflow during tab-complete(CVE-2024-39480)

    kernel:bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()(CVE-2024-39487)

    crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak(CVE-2024-39493)

    kernel:ima: Fix use-after-free on a dentry's dname.name(CVE-2024-39494)

    vmci: prevent speculation leaks by sanitizing event in event_deliver()(CVE-2024-39499)

    drivers: core: synchronize really_probe() and dev_uevent()(CVE-2024-39501)

    scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory(CVE-2024-40901)

    kernel:USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages(CVE-2024-40904)

    kernel:ipv6: prevent possible NULL dereference in rt6_probe()(CVE-2024-40960)

    scsi: qedi: Fix crash while reading debugfs attribute(CVE-2024-40978)

    kernel:ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.(CVE-2024-40984)

    kernel:net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()(CVE-2024-40995)

    kernel:ext4: fix uninitialized ratelimit_state-lock access in __ext4_fill_super()(CVE-2024-40998)

    kernel:netpoll: Fix race condition in netpoll_owner_active(CVE-2024-41005)

    kernel:tcp: avoid too many retransmit packets(CVE-2024-41007)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3189-1 advisory.

    The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-43907: drm/amdgpu/pm: fix the null pointer dereference in apply_state_adjust_rules     (bsc#1229787).
    - CVE-2024-43905: drm/amd/pm: fix the null pointer dereference for vega10_hwmgr (bsc#1229784).
    - CVE-2024-43902: Add null checker before passing variables (bsc#1229767).
    - CVE-2024-43900: Avoid use-after-free in load_firmware_cb() (bsc#1229756).
    - CVE-2024-43893: Check uartclk for zero to avoid divide by zero (bsc#1229759).
    - CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).
    - CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)
    - CVE-2024-43879: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()     (bsc#1229482).
    - CVE-2024-43872: RDMA/hns: Fix soft lockup under heavy CEQE load (bsc#1229489).
    - CVE-2024-43871: devres: Fix memory leakage caused by driver API devm_free_percpu() (bsc#1229490).
    - CVE-2024-43866: net/mlx5: Always drain health in shutdown callback (bsc#1229495).
    - CVE-2024-43863: drm/vmwgfx: Fix a deadlock in dma buf fence polling (bsc#1229497).
    - CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).
    - CVE-2024-43856: dma: fix call order in dmam_free_coherent (bsc#1229346).
    - CVE-2024-43854: block: initialize integrity buffer to zero before writing it to media (bsc#1229345)
    - CVE-2024-43839: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures (bsc#1229301).
    - CVE-2024-43831: media: mediatek: vcodec: Handle invalid decoder vsi (bsc#1229309).
    - CVE-2024-43819: Reject memory region operations for ucontrol VMs (bsc#1229290 git-fixes).
    - CVE-2024-42322: ipvs: properly dereference pe in ip_vs_add_service (bsc#1229347)
    - CVE-2024-42312: sysctl: always initialize i_uid/i_gid (bsc#1229357)
    - CVE-2024-42310: drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes (bsc#1229358).
    - CVE-2024-42309: drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes (bsc#1229359).
    - CVE-2024-42301: dev/parport: fix the array out-of-bounds risk (bsc#1229407).
    - CVE-2024-42285: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (bsc#1229381).
    - CVE-2024-42284: tipc: Return non-zero value from tipc_udp_addr2str() on error (bsc#1229382)
    - CVE-2024-42281: bpf: Fix a segment issue when downgrading gso_size (bsc#1229386).
    - CVE-2024-42280: Fix a use after free in hfcmulti_tx() (bsc#1229388)
    - CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)
    - CVE-2024-42259: drm/i915/gem: fix Virtual Memory mapping boundaries calculation (bsc#1229156).
    - CVE-2024-42246: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket     (bsc#1228989).
    - CVE-2024-42244: usb: serial: mos7840: fix crash on resume (bsc#1228967).
    - CVE-2024-42236: usb: gadget: configfs: prevent OOB read/write in usb_string_copy() (bsc#1228964).
    - CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)
    - CVE-2024-42228: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (bsc#1228667).
    - CVE-2024-42226: usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without     TRB (bsc#1228709).
    - CVE-2024-42162: gve: Account for stopped queues when reading NIC stats (bsc#1228706).
    - CVE-2024-42158: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings (bsc#1228720).
    - CVE-2024-42157: s390/pkey: Wipe sensitive data on failure (bsc#1228727).
    - CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys (bsc#1228733).
    - CVE-2024-42148: bnx2x: Fix multiple UBSAN array-index-out-of-bounds (bsc#1228487).
    - CVE-2024-42110: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()     (bsc#1228501).
    - CVE-2024-42106: inet_diag: Initialize pad field in struct inet_diag_req_v2 (bsc#1228493).
    - CVE-2024-42101: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes (bsc#1228495).
    - CVE-2024-42090: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (bsc#1228449).
    - CVE-2024-42082: xdp: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482).
    - CVE-2024-41098: ata: libata-core: Fix null pointer dereference on error (bsc#1228467).
    - CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).
    - CVE-2024-41068: s390/sclp: Fix sclp_init() cleanup on failure (bsc#1228579).
    - CVE-2024-41062: bluetooth/l2cap: sync sock recv cb and release (bsc#1228576).
    - CVE-2024-41035: usb: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor     (bsc#1228485).
    - CVE-2024-41020: filelock: Fix fcntl/close race recovery compat path (bsc#1228427).
    - CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
    - CVE-2024-40984: ACPICA: Revert 'ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.'     (bsc#1227820).
    - CVE-2024-39489: ipv6: sr: fix memleak in seg6_hmac_init_algo (bsc#1227623)
    - CVE-2024-38662: selftests/bpf: Cover verifier checks for mutating sockmap/sockhash (bsc#1226885).
    - CVE-2024-38618: ALSA: timer: Set lower bound of start tick time (bsc#1226754).
    - CVE-2024-36286: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()     (bsc#1226801)
    - CVE-2024-36270: Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch     (bsc#1226798)
    - CVE-2024-36013: Fix slab-use-after-free in l2cap_connect() (bsc#1225578).
    - CVE-2024-35965: Bluetooth: L2CAP: Fix not validating setsockopt user input (bsc#1224579).
    - CVE-2024-35933: Bluetooth: btintel: Fix null ptr deref in btintel_read_version (bsc#1224640).
    - CVE-2024-35915: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (bsc#1224479).
    - CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
    - CVE-2024-26851: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (bsc#1223074)
    - CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
    - CVE-2024-26677: Blacklist e7870cf13d20 (' Fix delayed ACKs to not set the reference serial number')     (bsc#1222387)
    - CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
    - CVE-2023-52907: nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame() (bsc#1229526).
    - CVE-2023-52893: gsmi: fix null-deref in gsmi_get_variable (bsc#1229535).
    - CVE-2023-52708: mmc: mmc_spi: fix error handling in mmc_spi_probe() (bsc#1225483).
    - CVE-2022-48920: Get rid of warning on transaction commit when using flushoncommit (bsc#1229658).
    - CVE-2022-48910: net: ipv6: ensure we call ipv6_mc_down() at most once (bsc#1229632).
    - CVE-2022-48875: wifi: mac80211: sdata can be NULL during AMPDU start (bsc#1229516).
    - CVE-2022-48865: Fix kernel panic when enabling bearer (bsc#1228065).
    - CVE-2022-48822: usb: f_fs: fix use-after-free for epfile (bsc#1228040).
    - CVE-2022-48786: vsock: remove vsock from connected table when connect is interrupted by a signal     (bsc#1227996).
    - CVE-2022-48769: efi: runtime: avoid EFIv2 runtime services on Apple x86 machines (bsc#1226629).
    - CVE-2022-48751: net/smc: transitional solution for clcsock race issue (bsc#1226653).
    - CVE-2021-47549: sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl (bsc#1225508).
    - CVE-2021-47425: i2c: acpi: fix resource leak in reconfiguration device addition (bsc#1225223).
    - CVE-2021-47373: irqchip/gic-v3-its: Fix potential VPE leak on error (bsc#1225190).
    - CVE-2021-47341: KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio     (bsc#1224923).
    - CVE-2021-47289: ACPI: fix NULL pointer dereference (bsc#1224984).
    - CVE-2021-47257: net: ieee802154: fix null deref in parse dev addr (bsc#1224896).
    - CVE-2021-4440: x86/xen: drop USERGS_SYSRET64 paravirt call (bsc#1227069).



Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2947-1 advisory.

    The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
    - CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
    - CVE-2021-47186: ipc: check for null after calling kmemdup (bsc#1222702).
    - CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
    - CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound     (bsc#1225505).
    - CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
    - CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
    - CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
    - CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
    - CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
    - CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
    - CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
    - CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
    - CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
    - CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path     (bsc#1227936).
    - CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
    - CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
    - CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
    - CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
    - CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
    - CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
    - CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
    - CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
    - CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
    - CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
    - CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
    - CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
    - CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
    - CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
    - CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
    - CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
    - CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
    - CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
    - CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
    - CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
    - CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
    - CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
    - CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
    - CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
    - CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
    - CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
    - CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
    - CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
    - CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
    - CVE-2024-35805: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743).
    - CVE-2024-35819: soc: fsl: qbman: Use raw spinlock for cgr_lock (bsc#1224683).
    - CVE-2024-35837: net: mvpp2: clear BM pool before initialization (bsc#1224500).
    - CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (bsc#1224604).
    - CVE-2024-35889: idpf: fix kernel panic on unknown packet types (bsc#1224517).
    - CVE-2024-35890: gro: fix ownership transfer (bsc#1224516).
    - CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
    - CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
    - CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
    - CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700)
    - CVE-2024-35961: net/mlx5: Restore mistakenly dropped parts in register devlink flow (bsc#1224585).
    - CVE-2024-35995: ACPI: CPPC: Fix access width used for PCC registers (bsc#1224557).
    - CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
    - CVE-2024-36004: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1224545)
    - CVE-2024-36901: ipv6: prevent NULL dereference in ip6_output() (bsc#1225711)
    - CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (bsc#1225719).
    - CVE-2024-36909: Drivers: hv: vmbus: Do not free ring buffers that couldn't be re-encrypted     (bsc#1225744).
    - CVE-2024-36910: uio_hv_generic: Do not free decrypted memory (bsc#1225717).
    - CVE-2024-36911: hv_netvsc: Do not free decrypted memory (bsc#1225745).
    - CVE-2024-36912: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752).
    - CVE-2024-36913: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753).
    - CVE-2024-36914: drm/amd/display: Skip on writeback when it's not applicable (bsc#1225757).
    - CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
    - CVE-2024-36923: fs/9p: fix uninitialized values during inode evict (bsc#1225815).
    - CVE-2024-36939: nfs: Handle error of rpc_proc_register() in nfs_net_init() (bsc#1225838).
    - CVE-2024-36946: phonet: fix rtm_phonet_notify() skb allocation (bsc#1225851).
    - CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
    - CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
    - CVE-2024-38558: net: openvswitch: fix overwriting ct original tuple for ICMPv6 (bsc#1226783).
    - CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
    - CVE-2024-38586: r8169: Fix possible ring buffer corruption on fragmented Tx packets (bsc#1226750).
    - CVE-2024-38598: md: fix resync softlockup when bitmap size is less than array size (bsc#1226757).
    - CVE-2024-38628: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind     (bsc#1226911).
    - CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
    - CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
    - CVE-2024-39463: 9p: add missing locking around taking dentry fid list (bsc#1227090).
    - CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
    - CVE-2024-39482: bcache: fix variable length array abuse in btree_iter (bsc#1227447).
    - CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
    - CVE-2024-39490: ipv6: sr: fix missing sk_buff release in seg6_input_core (bsc#1227626).
    - CVE-2024-39493: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (bsc#1227620).
    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-39497: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (bsc#1227722)
    - CVE-2024-39502: ionic: fix use after netif_napi_del() (bsc#1227755).
    - CVE-2024-39506: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
    - CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
    - CVE-2024-39508: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags (bsc#1227732).
    - CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
    - CVE-2024-40906: net/mlx5: Always stop health timer during driver removal (bsc#1227763).
    - CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
    - CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
    - CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()     (bsc#1227779).
    - CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
    - CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
    - CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
    - CVE-2024-40943: ocfs2: fix races between hole punching and AIO+DIO (bsc#1227849).
    - CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
    - CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)
    - CVE-2024-40958: netns: Make get_net_ns() handle zero refcount net (bsc#1227812).
    - CVE-2024-40959: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).
    - CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
    - CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
    - CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
    - CVE-2024-40967: serial: imx: Introduce timeout when waiting on transmitter empty (bsc#1227891).
    - CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
    - CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
    - CVE-2024-40977: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (bsc#1227950).
    - CVE-2024-40982: ssb: Fix potential NULL pointer dereference in ssb_device_uevent() (bsc#1227865).
    - CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).
    - CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).
    - CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()     (bsc#1227866).
    - CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
    - CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
    - CVE-2024-41009: selftests/bpf: Add more ring buffer test coverage (bsc#1228020).
    - CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
    - CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
    - CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
    - CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
    - CVE-2024-41016: ocfs2: add bounds checking to ocfs2_xattr_find_entry() (bsc#1228410).
    - CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
    - CVE-2024-41040: net/sched: Fix UAF when resolving a clash (bsc#1228518)
    - CVE-2024-41041: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (bsc#1228520)
    - CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
    - CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565)
    - CVE-2024-41057: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() (bsc#1228462).
    - CVE-2024-41058: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() (bsc#1228459).
    - CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
    - CVE-2024-41063: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580)
    - CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
    - CVE-2024-41066: ibmvnic: Add tx check to prevent skb leak (bsc#1228640).
    - CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
    - CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
    - CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing     (bsc#1228625).
    - CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
    - CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617)
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
    - CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers     (bsc#1228470)
    - CVE-2024-42079: gfs2: Fix NULL pointer dereference in gfs2_log_flush (bsc#1228672).
    - CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
    - CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
    - CVE-2024-42122: drm/amd/display: Add NULL pointer check for kzalloc (bsc#1228591)
    - CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705)
    - CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743)
    - CVE-2024-42161: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).
    - CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723)
    - CVE-2024-42230: powerpc/pseries: Fix scv instruction crash with kexec (bsc#1194869).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2929-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
    - CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)
    - CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743)
    - CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).
    - CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
    - CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
    - CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).
    - CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
    - CVE-2024-40956: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (bsc#1227810).
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
    - CVE-2024-39463: 9p: add missing locking around taking dentry fid list (bsc#1227090).
    - CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-35901: net: mana: Fix Rx DMA datasize and skb_over_panic (bsc#1224495).
    - CVE-2024-42230: powerpc/pseries: Fix scv instruction crash with kexec (bsc#1194869).
    - CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
    - CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
    - CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2894-1 advisory.

    The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2021-47086: phonet/pep: refuse to enable an unbound pipe (bsc#1220952).
    - CVE-2021-47103: net: sock: preserve kabi for sock (bsc#1221010).
    - CVE-2021-47186: tipc: check for null after calling kmemdup (bsc#1222702).
    - CVE-2021-47546: Kabi fix for ipv6: fix memory leak in fib6_rule_suppress (bsc#1225504).
    - CVE-2021-47547: net: tulip: de4x5: fix the problem that the array 'lp->phy' may be out of bound     (bsc#1225505).
    - CVE-2021-47588: sit: do not call ipip6_dev_free() from sit_init_net() (bsc#1226568).
    - CVE-2021-47590: mptcp: fix deadlock in __mptcp_push_pending() (bsc#1226565).
    - CVE-2021-47591: mptcp: remove tcp ulp setsockopt support (bsc#1226570).
    - CVE-2021-47593: mptcp: clear 'kern' flag from fallback sockets (bsc#1226551).
    - CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1226574).
    - CVE-2021-47599: btrfs: use latest_dev in btrfs_show_devname (bsc#1226571)
    - CVE-2021-47606: net: netlink: af_netlink: Prevent empty skb by adding a check on len (bsc#1226555).
    - CVE-2021-47623: powerpc/fixmap: Fix VM debug warning on unmap (bsc#1227919).
    - CVE-2022-48785: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() (bsc#1227927)
    - CVE-2022-48810: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path     (bsc#1227936).
    - CVE-2022-48850: net-sysfs: add check for netdevice being present to speed_show (bsc#1228071)
    - CVE-2022-48855: sctp: fix kernel-infoleak for SCTP sockets (bsc#1228003).
    - CVE-2023-52435: net: prevent mss overflow in skb_segment() (bsc#1220138).
    - CVE-2023-52573: net: rds: Fix possible NULL-pointer dereference (bsc#1220869)
    - CVE-2023-52580: net/core: Fix ETH_P_1588 flow dissector (bsc#1220876).
    - CVE-2023-52751: smb: client: fix use-after-free in smb2_query_info_compound() (bsc#1225489).
    - CVE-2023-52775: net/smc: avoid data corruption caused by decline (bsc#1225088).
    - CVE-2023-52812: drm/amd: check num of link levels when update pcie param (bsc#1225564).
    - CVE-2023-52857: drm/mediatek: Fix coverity issue with unintentional integer overflow (bsc#1225581).
    - CVE-2023-52863: hwmon: (axi-fan-control) Fix possible NULL pointer dereference (bsc#1225586).
    - CVE-2024-26585: Fixed race between tx work scheduling and socket close (bsc#1220187).
    - CVE-2024-26615: net/smc: fix illegal rmb_desc access in SMC-D connection dump (bsc#1220942).
    - CVE-2024-26633: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (bsc#1221647).
    - CVE-2024-26635: llc: Drop support for ETH_P_TR_802_2 (bsc#1221656).
    - CVE-2024-26636: llc: make llc_ui_sendmsg() more robust against bonding changes (bsc#1221659).
    - CVE-2024-26641: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() (bsc#1221654).
    - CVE-2024-26661: drm/amd/display: Add NULL test for 'timing generator' in (bsc#1222323)
    - CVE-2024-26663: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() (bsc#1222326).
    - CVE-2024-26665: tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328).
    - CVE-2024-26802: stmmac: Clear variable when destroying workqueue (bsc#1222799).
    - CVE-2024-26863: hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021).
    - CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del (bsc#1223652).
    - CVE-2024-27015: netfilter: flowtable: incorrect pppoe tuple (bsc#1223806).
    - CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
    - CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
    - CVE-2024-27025: nbd: null check for nla_nest_start (bsc#1223778)
    - CVE-2024-27065: netfilter: nf_tables: do not compare internal table flags on updates (bsc#1223836).
    - CVE-2024-27402: phonet/pep: fix racy skb_queue_empty() use (bsc#1224414).
    - CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
    - CVE-2024-35805: dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743).
    - CVE-2024-35819: soc: fsl: qbman: Use raw spinlock for cgr_lock (bsc#1224683).
    - CVE-2024-35837: net: mvpp2: clear BM pool before initialization (bsc#1224500).
    - CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (bsc#1224604).
    - CVE-2024-35889: idpf: fix kernel panic on unknown packet types (bsc#1224517).
    - CVE-2024-35890: gro: fix ownership transfer (bsc#1224516).
    - CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
    - CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
    - CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
    - CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700)
    - CVE-2024-35961: net/mlx5: Restore mistakenly dropped parts in register devlink flow (bsc#1224585).
    - CVE-2024-35979: raid1: fix use-after-free for original bio in raid1_write_request() (bsc#1224572).
    - CVE-2024-35995: ACPI: CPPC: Fix access width used for PCC registers (bsc#1224557).
    - CVE-2024-36000: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (bsc#1224548).
    - CVE-2024-36004: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (bsc#1224545)
    - CVE-2024-36901: ipv6: prevent NULL dereference in ip6_output() (bsc#1225711)
    - CVE-2024-36902: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (bsc#1225719).
    - CVE-2024-36909: Drivers: hv: vmbus: Do not free ring buffers that couldn't be re-encrypted     (bsc#1225744).
    - CVE-2024-36910: uio_hv_generic: Do not free decrypted memory (bsc#1225717).
    - CVE-2024-36911: hv_netvsc: Do not free decrypted memory (bsc#1225745).
    - CVE-2024-36912: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752).
    - CVE-2024-36913: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753).
    - CVE-2024-36914: drm/amd/display: Skip on writeback when it's not applicable (bsc#1225757).
    - CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (bsc#1225767).
    - CVE-2024-36923: fs/9p: fix uninitialized values during inode evict (bsc#1225815).
    - CVE-2024-36939: nfs: Handle error of rpc_proc_register() in nfs_net_init() (bsc#1225838).
    - CVE-2024-36946: phonet: fix rtm_phonet_notify() skb allocation (bsc#1225851).
    - CVE-2024-36974: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP (bsc#1226519).
    - CVE-2024-38555: net/mlx5: Discard command completions in internal error (bsc#1226607).
    - CVE-2024-38558: net: openvswitch: fix overwriting ct original tuple for ICMPv6 (bsc#1226783).
    - CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount (bsc#1226775).
    - CVE-2024-38586: r8169: Fix possible ring buffer corruption on fragmented Tx packets (bsc#1226750).
    - CVE-2024-38598: md: fix resync softlockup when bitmap size is less than array size (bsc#1226757).
    - CVE-2024-38628: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind     (bsc#1226911).
    - CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
    - CVE-2024-39371: io_uring: check for non-NULL file pointer in io_file_can_poll() (bsc#1226990).
    - CVE-2024-39463: 9p: add missing locking around taking dentry fid list (bsc#1227090).
    - CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
    - CVE-2024-39482: bcache: fix variable length array abuse in btree_iter (bsc#1227447).
    - CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
    - CVE-2024-39490: ipv6: sr: fix missing sk_buff release in seg6_input_core (bsc#1227626).
    - CVE-2024-39493: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (bsc#1227620).
    - CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
    - CVE-2024-39497: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (bsc#1227722)
    - CVE-2024-39502: ionic: fix use after netif_napi_del() (bsc#1227755).
    - CVE-2024-39506: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (bsc#1227729).
    - CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
    - CVE-2024-39508: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags (bsc#1227732).
    - CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
    - CVE-2024-40906: net/mlx5: Always stop health timer during driver removal (bsc#1227763).
    - CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
    - CVE-2024-40909: bpf: Fix a potential use-after-free in bpf_link_free() (bsc#1227798).
    - CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()     (bsc#1227779).
    - CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
    - CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
    - CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
    - CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
    - CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
    - CVE-2024-40943: ocfs2: fix races between hole punching and AIO+DIO (bsc#1227849).
    - CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
    - CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808)
    - CVE-2024-40958: netns: Make get_net_ns() handle zero refcount net (bsc#1227812).
    - CVE-2024-40959: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (bsc#1227884).
    - CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
    - CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
    - CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
    - CVE-2024-40967: serial: imx: Introduce timeout when waiting on transmitter empty (bsc#1227891).
    - CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
    - CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
    - CVE-2024-40977: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (bsc#1227950).
    - CVE-2024-40982: ssb: Fix potential NULL pointer dereference in ssb_device_uevent() (bsc#1227865).
    - CVE-2024-40989: KVM: arm64: Disassociate vcpus from redistributor region on teardown (bsc#1227823).
    - CVE-2024-40994: ptp: fix integer overflow in max_vclocks_store (bsc#1227829).
    - CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()     (bsc#1227866).
    - CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
    - CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
    - CVE-2024-41009: selftests/bpf: Add more ring buffer test coverage (bsc#1228020).
    - CVE-2024-41012: filelock: Remove locks reliably when fcntl/close race is detected (bsc#1228247).
    - CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
    - CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
    - CVE-2024-41015: ocfs2: add bounds checking to ocfs2_check_dir_entry() (bsc#1228409).
    - CVE-2024-41016: ocfs2: add bounds checking to ocfs2_xattr_find_entry() (bsc#1228410).
    - CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
    - CVE-2024-41040: net/sched: Fix UAF when resolving a clash (bsc#1228518)
    - CVE-2024-41041: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (bsc#1228520)
    - CVE-2024-41044: ppp: reject claimed-as-LCP but actually malformed packets (bsc#1228530).
    - CVE-2024-41048: skmsg: Skip zero length skb in sk_msg_recvmsg (bsc#1228565)
    - CVE-2024-41057: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() (bsc#1228462).
    - CVE-2024-41058: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() (bsc#1228459).
    - CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228561).
    - CVE-2024-41063: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() (bsc#1228580)
    - CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes (bsc#1228599).
    - CVE-2024-41066: ibmvnic: Add tx check to prevent skb leak (bsc#1228640).
    - CVE-2024-41069: ASoC: topology: Fix route memory corruption (bsc#1228644).
    - CVE-2024-41070: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() (bsc#1228581).
    - CVE-2024-41071: wifi: mac80211: Avoid address calculations via out of bounds array indexing     (bsc#1228625).
    - CVE-2024-41078: btrfs: qgroup: fix quota root leak after quota disable failure (bsc#1228655).
    - CVE-2024-41081: ila: block BH in ila_output() (bsc#1228617)
    - CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
    - CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
    - CVE-2024-42070: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers     (bsc#1228470)
    - CVE-2024-42079: gfs2: Fix NULL pointer dereference in gfs2_log_flush (bsc#1228672).
    - CVE-2024-42093: net/dpaa2: Avoid explicit cpumask var allocation on stack (bsc#1228680).
    - CVE-2024-42096: x86: stop playing stack games in profile_pc() (bsc#1228633).
    - CVE-2024-42122: drm/amd/display: Add NULL pointer check for kzalloc (bsc#1228591)
    - CVE-2024-42124: scsi: qedf: Make qedf_execute_tmf() non-preemptible (bsc#1228705)
    - CVE-2024-42145: IB/core: Implement a limit on UMAD receive List (bsc#1228743)
    - CVE-2024-42161: Avoid uninitialized value in BPF_CORE_READ_BITFIELD (bsc#1228756).
    - CVE-2024-42224: net: dsa: mv88e6xxx: Correct check for empty list (bsc#1228723)
    - CVE-2024-42230: powerpc/pseries: Fix scv instruction crash with kexec (bsc#1194869).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

    * kernel info leak issue in pfkey_register (CVE-2022-1353)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

    * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

    * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816,     CVE-2022-29900)

    * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

    * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nf_tables disallow binding to already bound chain (CVE-2022-39190)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7683 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

    * race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference     (CVE-2020-36558)

    * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

    * memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c     (CVE-2021-30002)

    * smb2_ioctl_query_info NULL Pointer Dereference (CVE-2022-0168)

    * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

    * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

    * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016)

    * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

    * use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055)

    * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

    * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

    * buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

    * openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

    * use-after-free when psi trigger is destroyed while being polled (CVE-2022-2938)

    * net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

    * Spectre-BHB (CVE-2022-23960)

    * Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

    * memory leak in drivers/hid/hid-elo.c (CVE-2022-27950)

    * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

    * use after free in SUNRPC subsystem (CVE-2022-28893)

    * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

    * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.181-99.354. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-023 advisory.

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26401)

    An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (CVE-2021-47617)

    Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure. (CVE-2022-0001)

    Non-transparent sharing of branch predictor within a context in some Intel(r) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

    A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

    The Amazon Linux kernel now enables, by default, a software mitigation for this issue, on all ARM-based     EC2 instance types. (CVE-2022-23960)

    A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: improve size validations for received domain records (CVE-2022-48711)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (CVE-2022-48724)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock between quota disable and qgroup rescan worker (CVE-2022-48734)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (CVE-2022-48742)

    In the Linux kernel, the following vulnerability has been resolved:

    net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (CVE-2022-48775)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: remove vsock from connected table when connect is interrupted by a signal (CVE-2022-48786)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-rdma: fix possible use-after-free in transport error_recovery work (CVE-2022-48788)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: fix a possible use-after-free in controller reset during load (CVE-2022-48790)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix list corruption in perf_cgroup_switch() (CVE-2022-48799)

    In the Linux kernel, the following vulnerability has been resolved:

    vt_ioctl: fix array_index_nospec in vt_setactivate (CVE-2022-48804)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (CVE-2022-48805)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix a memleak when uncloning an skb dst and its metadata (CVE-2022-48809)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (CVE-2022-48810)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedf: Fix refcount issue when LOGO is received during TMF (CVE-2022-48823)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.102-99.473. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-011 advisory.

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26401)

    An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (CVE-2021-47617)

    Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure. (CVE-2022-0001)

    Non-transparent sharing of branch predictor within a context in some Intel(r) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

    A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

    A flaw was found in the way the flags member of the new pipe buffer structure was lacking proper     initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus     contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache     backed by read only files and as such escalate their privileges on the system. (CVE-2022-0847)

    A use-after-free vulnerability was found in the tc_new_tfilter function in net/sched/cls_api.c in the     Linux kernel. The availability of local, unprivileged user namespaces allows privilege escalation.
    (CVE-2022-1055)

    The Amazon Linux kernel now enables, by default, a software mitigation for this issue, on all ARM-based     EC2 instance types. (CVE-2022-23960)

    A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: improve size validations for received domain records (CVE-2022-48711)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: fix error handling in ext4_fc_record_modified_inode() (CVE-2022-48712)

    In the Linux kernel, the following vulnerability has been resolved:

    perf/x86/intel/pt: Fix crash with stop filters in single-range mode (CVE-2022-48713)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Use VM_MAP instead of VM_ALLOC for ringbuf (CVE-2022-48714)

    In the Linux kernel, the following vulnerability has been resolved:

    net: macsec: Fix offload support for NETDEV_UNREGISTER event (CVE-2022-48720)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (CVE-2022-48724)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/ucma: Protect mc during concurrent multicast leaves (CVE-2022-48726)

    In the Linux kernel, the following vulnerability has been resolved:

    IB/hfi1: Fix AIP early init panic (CVE-2022-48728)

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock between quota disable and qgroup rescan worker (CVE-2022-48734)

    In the Linux kernel, the following vulnerability has been resolved:

    selinux: fix double free of cond_list on error paths (CVE-2022-48740)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (CVE-2022-48742)

    In the Linux kernel, the following vulnerability has been resolved:

    net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5: Use del_timer_sync in fw reset flow of halting poll (CVE-2022-48745)

    In the Linux kernel, the following vulnerability has been resolved:

    net/mlx5e: Fix handling of wrong devices during bond netevent (CVE-2022-48746)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: Forcibly leave nested virt when SMM state is toggled (CVE-2022-48763)

    In the Linux kernel, the following vulnerability has been resolved:

    xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CVE-2022-48773)

    In the Linux kernel, the following vulnerability has been resolved:

    Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (CVE-2022-48775)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: remove vsock from connected table when connect is interrupted by a signal (CVE-2022-48786)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-rdma: fix possible use-after-free in transport error_recovery work (CVE-2022-48788)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme: fix a possible use-after-free in controller reset during load (CVE-2022-48790)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix potential use-after-free during probe (CVE-2022-48796)

    In the Linux kernel, the following vulnerability has been resolved:

    mm: don't try to NUMA-migrate COW pages that have other uses (CVE-2022-48797)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix list corruption in perf_cgroup_switch() (CVE-2022-48799)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/proc: task_mmu.c: don't read mapcount for migration entry (CVE-2022-48802)

    In the Linux kernel, the following vulnerability has been resolved:

    vt_ioctl: fix array_index_nospec in vt_setactivate (CVE-2022-48804)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (CVE-2022-48805)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix a memleak when uncloning an skb dst and its metadata (CVE-2022-48809)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (CVE-2022-48810)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: lantiq_gswip: don't use devres for mdiobus (CVE-2022-48812)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: felix: don't use devres for mdiobus (CVE-2022-48813)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: bcm_sf2: don't use devres for mdiobus (CVE-2022-48815)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: ar9331: register the mdiobus under devres (CVE-2022-48817)

    In the Linux kernel, the following vulnerability has been resolved:

    net: dsa: mv88e6xxx: don't use devres for mdiobus (CVE-2022-48818)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedf: Fix refcount issue when LOGO is received during TMF (CVE-2022-48823)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: qedf: Add stag_work to all the vports (CVE-2022-48825)

    A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.
    This issue may allow a local attacker with user privilege to cause a denial of service. (CVE-2023-1582)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.268-205.500. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1761 advisory.

    A buffer overflow flaw in the Linux kernel BPF subsystem was found in the way users run BPF with long jump     over an instruction sequence where inner instructions require substantial expansions into multiple BPF     instructions. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2018-25020)

    A denial of service flaw was found in fuse_do_getattr in fs/fuse/dir.c in the kernel side of the FUSE     filesystem in the Linux kernel. A local user could use this flaw to crash the system. (CVE-2020-36322)

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26341)

    AMD recommends using a software mitigation for this issue, which the kernel is enabling by default. The     Linux kernel will use the generic retpoline software mitigation, instead of the specialized AMD one, on     AMD instances (*5a*). This is done by default, and no administrator action is needed. (CVE-2021-26401)

    A flaw was found in the hanging of mounts in the Linux kernel's NFS4 subsystem where remote servers are     unreachable for the client during migration of data from one server to another (during trunking     detection). This flaw allows a remote NFS4 server (if the client is connected) to starve the resources,     causing a denial of service. The highest threat from this vulnerability is to system availability.
    (CVE-2021-38199)

    An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces     subsystem was found in the way users have access to some less privileged process that are controlled by     cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of     control groups. A local user could use this flaw to crash the system or escalate their privileges on the     system. (CVE-2021-4197)

    In the Linux kernel, the following vulnerability has been resolved:

    Bluetooth: refactor malicious adv data check (CVE-2021-47620)

    Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may     allow an authorized user to potentially enable information disclosure. (CVE-2022-0001)

    Non-transparent sharing of branch predictor within a context in some Intel(r) Processors may allow an     authorized user to potentially enable information disclosure via local access. (CVE-2022-0002)

    A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the     way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or     escalate their privileges on the system. (CVE-2022-0330)

    A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends     a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.
    This flaw allows a remote user to crash the system or possibly escalate their privileges if they have     access to the TIPC network. (CVE-2022-0435)

    A NULL pointer dereference was found in the Linux kernel's UDF file system functionality in the way the     user triggers the udf_file_write_iter function for a malicious UDF image. This flaw allows a local user to     crash the system. (CVE-2022-0617)

    The Amazon Linux kernel now enables, by default, a software mitigation for this issue, on all ARM-based     EC2 instance types. (CVE-2022-23960)

    A flaw was found in the Linux kernel. When an application tries to open a directory (using the O_DIRECTORY     flag) in a mounted NFS filesystem, a lookup operation is performed. If the NFS server returns a file as a     result of the lookup, the NFS filesystem returns an uninitialized file descriptor instead of the expected     ENOTDIR value. This flaw leads to the kernel's data leak into the userspace. (CVE-2022-24448)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: improve size validations for received domain records (CVE-2022-48711)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() (CVE-2022-48724)

    In the Linux kernel, the following vulnerability has been resolved:

    rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() (CVE-2022-48742)

    In the Linux kernel, the following vulnerability has been resolved:

    net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix information leakage in /proc/net/ptype (CVE-2022-48757)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: core: Fix hang in usb_kill_urb by adding memory barriers (CVE-2022-48760)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: remove vsock from connected table when connect is interrupted by a signal (CVE-2022-48786)

    In the Linux kernel, the following vulnerability has been resolved:

    perf: Fix list corruption in perf_cgroup_switch() (CVE-2022-48799)

    In the Linux kernel, the following vulnerability has been resolved:

    vt_ioctl: fix array_index_nospec in vt_setactivate (CVE-2022-48804)

    In the Linux kernel, the following vulnerability has been resolved:

    net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (CVE-2022-48805)

    In the Linux kernel, the following vulnerability has been resolved:

    net: fix a memleak when uncloning an skb dst and its metadata (CVE-2022-48809)

    In the Linux kernel, the following vulnerability has been resolved:

    ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path (CVE-2022-48810)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
274115	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990431)	Nessus	Unity Linux Local Security Checks	medium
272373	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990056)	Nessus	Unity Linux Local Security Checks	medium
270889	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987569)	Nessus	Unity Linux Local Security Checks	medium
225214	Linux Distros Unpatched Vulnerability : CVE-2022-48786	Nessus	Misc.	medium
211847	RHEL 8 : kernel (RHSA-2024:10273)	Nessus	Red Hat Local Security Checks	medium
209785	EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2024-2781)	Nessus	Huawei Local Security Checks	high
209777	EulerOS Virtualization 2.12.1 : kernel (EulerOS-SA-2024-2763)	Nessus	Huawei Local Security Checks	high
208351	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-2519)	Nessus	Huawei Local Security Checks	high
208330	EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-2544)	Nessus	Huawei Local Security Checks	high
207658	RHEL 9 : kernel (RHSA-2024:6991)	Nessus	Red Hat Local Security Checks	high
207649	RHEL 9 : kernel-rt (RHSA-2024:6990)	Nessus	Red Hat Local Security Checks	high
207334	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2024:3251-1)	Nessus	SuSE Local Security Checks	high
207332	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:3252-1)	Nessus	SuSE Local Security Checks	high
207170	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2024-2369)	Nessus	Huawei Local Security Checks	high
207120	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2024-2394)	Nessus	Huawei Local Security Checks	high
206954	SUSE SLES12 Security Update : kernel (SUSE-SU-2024:3189-1)	Nessus	SuSE Local Security Checks	high
205747	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2947-1)	Nessus	SuSE Local Security Checks	high
205734	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2939-1)	Nessus	SuSE Local Security Checks	high
205650	SUSE SLES15 Security Update : kernel (SUSE-SU-2024:2929-1)	Nessus	SuSE Local Security Checks	high
205493	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2024:2894-1)	Nessus	SuSE Local Security Checks	high
167620	RHEL 9 : kernel (RHSA-2022:8267)	Nessus	Red Hat Local Security Checks	high
167155	RHEL 8 : kernel (RHSA-2022:7683)	Nessus	Red Hat Local Security Checks	high
161456	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-023 (ALASKERNEL-5.4-2022-023)	Nessus	Amazon Linux Local Security Checks	high
160425	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-011 (ALASKERNEL-5.10-2022-011)	Nessus	Amazon Linux Local Security Checks	high
158720	Amazon Linux 2 : kernel, --advisory ALAS2-2022-1761 (ALAS-2022-1761)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-48786

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high